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1BSTB1CT 

This  thesis  is  intended  to  becose  a  portion  of  the  textbook 
utilized  in  the  conrse  entitled  "Warheads  and  lethality" 
(AE-3705).  This  portion  of  the  text  includes  an  unclassi¬ 
fied  discussion  of  a  target's  susceptibility  to  an  exter¬ 
nally  detonating  HE  warhead  and  a  target's  vulnerability. 
In  particular,  the  section  on  target  susceptibility  leads  to 
the  development  of  the  number  of  fragments  which  strike  a 
target  aircraft  from  an  externally  detonating  warhead.  The 
section  on  target  vulnerability  explains  the  methodology 
used  for  identifying  critical  components  and  conducting  a 
vulnerability  assessaent,  and  leads  to  the  effects  of  frag¬ 
ments  and  penetrators  striking  an  aircraft. 
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I.  SUSCEPTIBILITY  TC  EXTERHA1IY  DETONATING  FRAGMENTATION 

WARHEADS 


A.  I1TRCDOCTIOB 

Susceptibility  refers  to  the  inability  of  a  target  to 
avoid  being  damaged  in  the  pursuit  of  its  mission.  For 
aircraft,  susceptibility  to  an  externally  detonating  warhead 
refers  to  an  aircraft’s  probability  of  being  hit. 
Susceptibility,  like  vulnerability,  is  good.  The  level  or 
degree  of  susceptibility  of  an  aircraft  in  an  encounter  with 
a  threat  is  dependent  upon  three  major  factors,  the 
encounter  scenario,  the  threat,  and  the  aircraft.  The 
encounter  scenario  includes  the  missile  and  aircraft  posi¬ 
tions,  velocity  vectors,  respective  attitudes,  a  determina¬ 
tion  of  the  warhead's  fragment  dynamic  spray  angles,  a 
determination  of  the  missile  miss  distance,  and  the  determi¬ 
nation  of  how  many  fragments  or  penetrators  strike  the 
aircraft.  The  important  features  of  the  threat  are  its 
characteristics,  its  operations,  and  its  lethality.  The 
important  aircraft  features  are  the  aircraft  detectable 
signatures,  countermeasures,  performance  capabilities,  and 
self-protection  armament. 

B.  EBCOONTEB  SCENARIO 

The  encounter  scenario  takes  into  account  the  missile's 
flight  path  and  the  target's  flight  path  to  allow  calcula¬ 
tion  of  the  missile  miss  distance,  fragment  miss  distance, 
the  warhead's  dynamic  fragment  spray  angles  and  velocities, 
and  the  number  of  fragments  which  strike  the  target. 


1 1 


in  Local  Coordinate  System 


istance  Depicted 
e  Systea 


The  derivation  of  the  minimum  aissile  aiss  distance  in  the 
local  system  follows  the  same  procedure  as  for  the  global 
system,  and  since  it  leads  to  the  same  result  as  given  by 
Equation  1.17,  the  derivation  will  not  be  repeated. 

From  the  geometry  of  Figure  1. 5,  it  is  possible 
to  determine  if  the  missile  will  be  a  "late  bird"  or  an 
"early  bird".  An  "early  bird"  is  where  the  closest  point  of 
approach  (CPA)  of  the  missile  is  in  front  of  the  target  in 
the  local  system.  A  "late  bird"  is  where  the  CPA  of  the 
aissile  is  behind  the  target.  This  relationship  may  be 
determined  graphically  with  the  use  of  the  following 
formula : 

9  =  Tan-i  [  (Vm  x  Sine  )  /  [  x  Cos  9  )  -  Vt  ]  ]  (1.22) 

Now  that  the  missile  miss  distance  has  been 
calculated,  and  knowing  the  fragment  spray  density,  a  deter¬ 
mination  must  be  made  as  to  whether  or  not  the  fragments  hit 
the  target,  and  if  so,  how  many  fragments  strike  the  target. 
To  accomplish  this,  the  fragment  miss  distance  must  be 
determined. 

4  .  Fragment  Miss  Distance 

As  was  the  case  for  missile  miss  distance,  the  frag¬ 
ment  miss  distance  may  be  derived  in  either  a  global  coordi¬ 
nate  system  or  in  a  local  coordinate  system.  Figure  1.6 
depicts  the  fragment  miss  distance  for  the  global  coordinate 
system,  and  Figure  1.7  depicts  the  miss  distance  for  the 
global  system  using  vector  notation.  Figure  1.8  depicts  the 
fragment  miss  distance  in  the  local  coordinate  system.  The 
derivation  of  the  fragment  miss  distance  in  a  global  coordi¬ 
nate  system  follows.  Referring  to  Figure  1.7,  and  using 
vector  addition,  the  fragment  miss  distance,  "c,  is  given  by 
Equation  1.23. 


Figure  1.5  Ercounter  Scenario  in  the  local  Systea 


Of  interest  is  the  minimum  miss  distance.  Taking  the  deriv¬ 
ative  of  Equation  1.17  with  respect  to  x ,  and  setting  it 
equal  to  zero  yields: 

C  ( £TX  -  Mx}  x  {V.  -  {V  x  Cos  0  ) } ) 
x  (Vm  x  Sin  e  )  }  ]  ♦  [  T  X  [  £Vt 
♦  (Vm  X  Sin  0)  2]]  =  0 

Solving  Equation  1.18  for  x  yields  r  for  the  minimum  miss 
distance  which  is: 

=  t((Ty  ~  My)  X  7m  X  Sin  0)  +  ((Tx  ~  Mx)  (1.19) 

x  V  x  Cos  0 )  -  ( (T  -  a  )  x  7  )  ]  / 
m  x  x  t 

[  (Vt  -  (\  x  Cos  0))  2  ♦  (Va  x  Sin  0)  2  ] 

The  minimum  missile  miss  distance  is  then  given  by  substi¬ 
tuting  the  value  of  x  ,  obtained  from  Equation  1.19,  into 
Equation  1.17. 

b.  Local  Approach 

The  local  approach  is  an  alternative  approach  to  the  one 
described  above.  In  the  local  approach,  the  target  remains 
stationary  and  the  target’s  velocity  vector  is  superimposed 
on  the  missile's  velocity  vector.  This  geometry  is  depicted 
in  Figure  1.5.  From  Figure  1.5,  the  velocity  of  the  missile 
with  the  target's  velocity  superimposed,  vmt  ,  becomes: 

V  =  (7  x  Cos  0)i  ♦  (7  x  Sin  0)  j*  -  (7.)?  (1.20) 

ro  m 

Rearranging  Equation  1.20  into  a  more  suitable  form  gives: 

=  HVm  x  Cos  0)  -  7t  ]i  ♦  [7m  x  Sin  0  ]j*  (1.21) 


-  £(T  -  M  )  (1.18) 

y  y 

-  (7  x  Cos  6 )} 2 
m 
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T*t  =  M*m*s  (1.9) 

Rearranging  Equation  1.9  and  solving  for  s  leads  to: 

s  =  (T  -  M)  +  (t  -  m)  (1.  10) 


The  initial  conditions  (at  time  t  =  0)  are  given  by 

Equations  1.11  and  1.12.  The  conditions  at  some  later  time 
(t  =  t  )  are  given  by  Equations  1.13  and  1.14. 


T  =  (Tx)i  ♦  (Ty)  j 
M  =  (MJ?  ♦  (My)  ? 
t  =  (Vfc  X  T  )  1* 

_  «  A 

m  =  (V  x  t  x  Cos q  )i  ♦  (V  x  t  x  Sin  9 ) j 
m  m 

Substituting  these  conditions  back  into  Equation 


(1.  11) 
(1.  12) 
(1.  13) 
(1.  14) 

1.10  gives : 


s  -  [  (Tx  -  Mx)i  ♦  <Ty  *  «y)  ♦  [  ((Vt  X  T)  (1.15) 

-  (V  x  T  X  Cos9))i  -  (V  x  T  X  Sin0)3*] 

m  m 

Rearranging  Equation  1.15  and  combining  similar  components 
gives: 

1  =  t  (Tx  -  Mx)  ♦  [  x  (7t  -  (Vm  x  Cos  e  ))  ]]i  (1.  16) 

♦  [  (T  -  H  )  -  (V  x  t  X  Sin  9  )  ]j 

y  y  m 

The  missile  miss  distance  is  given  by  taking  the  magnitude 
of  Equation  1.  16  which  is: 

|s|  =  [  (T  -  M  )  ♦  [  t  x  (V  -  (7  x  Cos  9  ))  ]]2  ,, 

♦  XX  t  m  (1. 17) 

+  C  (Ty  -  Hy )  -  (Vm  x  T  x  Sin  9  )  ]2 
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Figure  1.4  Global  Systea  Encounter  Scenario 
Using  Vector  Rotation 


Figure  1.3  Typical  Encounter  Scenario 
in  the  Global  Systen 


p 


N  /  A 


(1.5) 


where  N  is  the  total  number  of  fragments  in  the  warhead  and 
A  is  the  area  the  fragments  are  spread  over.  Referring  to 
Figure  1.2,  the  area.  A,  is  given  by: 

*2 

(s  x  Sin  4> )  x  s  d4>  (1.6) 

l 

Solving  Eguation  1.6  leads  to  the  solution: 

A  =  2  x  ttxs*x  (Cos  4^  -  Ccs  4>2  )  (1.7) 

Substituting  Equation  1.7  into  Equation  1.5  yields  the  frag¬ 
ment  spray  density  at  some  distance  s  from  the  detonation 
point : 

p  3  N  /  [  2  x  ir  x  s2  x  (Cos  4>  i  -  Cos  )  ]  (1.8) 

where  the  leading  and  trailing  dynamic  fragment  spray  angles 
are  defined,  with  respect  to  the  warhead  axis,  by  Equation 
1.4. 

3*  Missile  Miss  Eistance 

For  the  calculation  of  aissile  miss  distance,  it  is 
assumed  that  the  encounter  is  two  dimensional,  and  that  the 
target's  velocity  and  the  missile's  velocity  remain 
constant.  Two  approaches  to  calculate  the  miss  distance 
will  he  presented.  The  first  approach  is  the  global 
approach. 

a.  Global  Approach 

Figure  1.3  depicts  a  typical  encounter  situation.  Figure 
1.4  depicts  the  same  encounter  situation  using  vector  nota¬ 
tion.  Referring  to  Figure  1.4,  and  using  vector  addition, 
the  missile  miss  distance,  s,  is  given  by  Equation  1.9. 
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Figure  1.2  Saaple  Encounter  with  a  Horizontally  Moving 
Aircraft  Depicting  the  Fragment  Spray  Density 


Again  referring  to  Figure  1.1,  the  dynamic  fragment  velocity 
may  fce  written  in  vector  notation  as: 

▼i  *  Cvm  +  (vs  x  CcsctJ  ]i  ♦  Ps  x  Sina.Jj  (1.3) 

Solvirg  Eguation  1.3  for  the  dynamic  fragment  spray  angle, 
<j>.  ,  yields: 

H  =  Tan-»[  (Vs  x  Sinai)  /  l\  ♦  (Vs  x  Cose*)]]  (1.4) 

Now  that  the  dynamic  fragment  spray  angles  and  velocities 
are  known,  the  fragment  spray  density  may  be  determined. 

2.  Fragment  Spray  Density 

Ihe  damage  inflicted  or  an  aircraft  depends  on  the 
number  and  the  location  of  the  fragment  impacts,  and  on  the 
terminal  effects  parameters  such  as  the  fragment  mass  and 
impact  velocity.  For  this  derivation  of  the  fragment  spray 
density,  the  following  assumptions  are  made: 

1.  The  fragments  lie  on  a  spherical  segment  whose  center 
is  at  the  center  of  the  warhead. 

2.  The  fragments  emerge  from  the  warhead  in  such  a  way 
that  they  remain  on  the  surface  of  an  expanding  sphere. 

An  encounter  scenario  with  a  horizontally  moving  aircraft, 
and  based  on  the  assumptions  stated  above,  is  depicted  in 
Figure  1.2. 

For  any  given  fragment  spray  zone,  the  density  of 
fragments  within  that  zone  is  simply  the  number  of  fragments 
contained  in  the  zone  divided  by  the  surface  area  of  the 
sphere  contained  within  the  conical  angles  defining  the 
zone.  The  average  cumber  of  fragments  per  unit  area  of 
fragment  spray,  known  as  the  frajment  spray  density  ,  p  ,  is 
given  by  Eguation  1.5. 
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ure  1.1  Typical  Warhead  Depicting 
ynaaic  Spray  Angles  and  Velocities 


1 .  Warhead  Dynamic  Spray  Angies  and  Velocities 

When  a  warhead  detonates  in  the  vicinity  of  an 
aircraft,  the  fragments  or  peEetrators  are  usually  ejected 
uniformly  around  the  missile  axis  and  propagate  outward  in  a 
divergent  spherical- like  spray  pattern  at  a  velocity  that  is 
the  vector  sum  of  the  initial  fragment  ejection  velocity 
from  a  static  warhead  detonaticn  and  the  missile  velocity. 
The  fragment  at  the  front  of  the  warhead  is  assumed  to 
propagate  outward  at  the  leading  spray  angle,  and  the  frag¬ 
ment  at  the  tail  end  of  the  warhead  is  assumed  to  propagate 
along  trajectory  at  the  trailing  spray  angle.  All  other 
fragment  trajectories  lie  between  these  two  spray  angles  and 
constitute  the  fragment  spray.  As  the  aircraft  moves  in 
space,  the  fragments  propagate  outward  and  eventually  some 
of  the  fragments  may  strike  the  aircraft.  Whether  or  not 
any  of  the  fragments  strike  the  aircraft  and  where  they  hit 
depend  upon  the  relative  positions,  velocities,  and  the 
attitude  of  the  warhead  and  the  aircraft  at  the  time  of 
detonation  (encounter  conditions)  and  the  fragment  static 
velocities  and  static  spray  angles.  A  sample  warhead 
depicting  static  fragment  spray  angles  and  velocities,  and 
dynamic  fragment  spray  angles  and  velocities  is  depicted  in 
Figure  1.1.  Using  the  law  of  cosines  and  Figure  1.1,  the 
dynamic  fragment  velocity,  V,^  ,  is  given  by: 

=  Vm2  +  Vsz  -  (2  x  Vm  x  Vs  x  Cos  8  )  (1.1) 

where  is  the  missile  velocity  and  Vs  is  the  static  frag¬ 
ment  velocity.  Since  the  angle  S  is  not  known,  Eguation  1.  1 
must  be  rearranged  to  use  the  orly  known  angle,  which  is  the 
static  fragment  spray  angle,  a  .  Rearranging  Eguation  1.1, 
the  dynamic  fragment  velocity  is  given  by: 

y  2=72  +  7  2  -  [2  xv  XV  x  Cos ( 1 80-a . )  ]  (1.2) 

i  m  s  m  s  1 
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c 


(1.23) 


=  (T  -  F)  ♦  (t  -  f) 

The  initial  conditions  are  given  by  Equations  1.24  and  1.25. 
The  conditions  at  sene  later  time  (t  =  t  )  are  given  by 
Equations  1.26  and  1.27. 


A  A 


T  =  (Tx)i  ♦  (T  )j 

y 

(1.24) 

F  =  (Fx)l  +  (Fy)  “j 

(1.25) 

t  =  ( V  t  X  T  )  i 

(1.26) 

f  =  ( V  ^  x  x  x  Cos  y  )  i  +  (Vi  x 

t  x  Sin  Y  )  'j' 

(1.27) 

Substituting  these  conditions  tack  into  Equation  1.23,  and 
solving  for  c,  leads  to: 

c  =  [  (Tx  -  FXJ  -  (  t  x  {(V.  X  COST)  -  Vt )  )  ]i  (1.28) 

[  (Ty  -  Fy)  -  (  x  x  \  X  Sin  Y)  ]T 

The  magnitude  of  Equation  1.28  is: 

|C|  =  L  (Tx  -  Fx)  -  {  x  x  {{Vi  x  Cos  Y)  -  Vt)J  ]*  (1.29) 

♦  [  -Fy )  -  (  t  x  VA  x  Sin  Y)  ]* 

To  find  the  minimum  fragment  miss  distance,  t  for  the 
minimum  miss  distance  is  needed.  Taking  the  derivative  cf 
Equation  1.29  with  respect  to  r  ,  and  setting  it  equal  to 
zero  yields: 

x  =  C  {  (Tx  -  Fx)  x  {(V.  x  Cos  y)  -  Vt}}  ♦  (1.33) 

{ ( Ty  -  Fy)  x  V.  x  Sin  Y]  ]  /  [  l(V  x  Cos  Y)  - 

+  (V  x  Sin  Y)  2  ] 
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To  find  the  minimum  fragment  siss  distance,  simply  solve 
Equation  1.30  for  r  ,  and  substitute  that  value  of  t  into 
Equation  1.29.  This  derivation  assumed  that  the  fragment 
velocity  was  constant.  If  the  fragment  velocity  is  not 
constant,  or  reasonably  so,  then  f  is  given  by: 

f  =  j  [  (V.  x  Co s  y  )  i  ♦  (V.  x  Sin  y  )  j  ]  dr  ( 1  -  31) 

Solving  Eguation  1.31  gives: 

f  =  [  (Cos  y  )  i  +  (S  in  Y  }  3  ]  X  f  Vi  (  t  )  dT  (1*32) 

Q 

Now  that  the  fragment  miss  distance  has  been  calculated,  the 
number  of  fragments  which  strike  the  target  will  be 
determined. 

5  •  If aa®ent  Impacts  on  the  Target 

The  number  of  hits,  n,  on  the  aircraft  presented 
area  at  the  aspect  under  consideration,  Ap ,  is  given  by: 

n  =  P  x  Ap  (1*33) 

where  p  is  the  fragment  spray  density  defined  by  Eguation 
1.8.  Figure  1.9  depicts  the  fragment  spray  density  striking 
an  aircraft  in  the  local  coordinate  system  described 
earlier,  where  f  ^  and  f2  represent  the  leading  edge  and 
trailing  edge  fragment  vectors,  respectively.  The  angle  y 
is  defined  as: 

y  =  Tan- 1  [  (V.  x  Siny.  )  /  (  (V  x  Cosy  )  -  V  )  ]  (1.34) 

1  i  1  i  t 

Figure  1.10  depicts  the  same  geometry  in  the  global  coordi¬ 
nate  system  described  earlier.  Recall  from  Equation  1.8 
that  the  distance  the  fragments  travel  before  striking  the 
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The  time  from  detona- 


aircraft,  F,  is  needed  and  not  Fdet 
tion  to  fragment  impact  in  the  global  system  is: 


t  =  E  /  Vi  (1.35) 

The  time  from  detonation  to  fragment  impact  in  the  local 
system  is: 


1  ®  det  ^  ^  ft 


(1- 36) 


where  v  ft  is  defined  as  follows: 


Vft  2  =  [  (Vi  x  Cosy  )  -  V  ]*  ♦  [V  x  SinY  ]*  (1.37) 

Equating  Equation  1.35  to  Equation  1.36,  and  solving  for  R 
yields: 


R2  =  H  2  /  [  1  -  (2  x  (V  /V  )  x  CosY  )  (1.38) 

dct  t  i 

♦  (Vt/V.)2] 

where  Vfc  is  the  target  velocity  and  7^  is  the  dynamic  frag¬ 
ment  velocity  as  defined  by  Equation  1.2.  The  extent  of  the 
fragment  spray  which  strikes  the  aircraft,  and  the  number 
and  location  of  fragment  hits,  are  dependent  upon  the 
encounter  conditions.  Figure  1.11  depicts  the  effects  of 
varying  the  detonation  distance  to  the  target.  In  zone  1, 
the  full  fragment  spray  hits  the  target.  In  zone  2,  all  of 
the  target  is  hit  by  part  of  the  fragment  spray.  In  zones  3 
and  *»,  part  of  the  fragment  spray  hits  part  of  the  target. 
In  zone  1,  with  the  target  hit  by  the  full  fragment  spray, 
the  presented  area  of  the  aircraft  may  be  determined  as 
follows.  Figure  1.12  depicts  a  frontal  view  of  the  fragment 
spray  striking  an  aircraft.  From  Figure  1.12,  the  angle  t, 
is  defined  by  Equation  1.39. 
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Figure  1.11  Effect  of  Varying  Detonation  Distance  on 
Fragments  lapacting  on  an  Aircraft 


Figure  1.12  Frontal  View  of  Fragments 
Impacting  an  Aircraft 


;  =  Tan-1  [W  /  (2  x  R  x  Sint  )]  (1.39) 

The  circumferential  length  of  the  spray  zone  is  define!  as: 

b  =  2  x  £xRx  Sint  (1.40) 

where  t  is  the  dynamic  fragment  spray  angle  of  the  center 
fragment.  Substituting  Equation  1.39  into  Equation  1.40 
yields: 

b  =  2  x  R  x  Sint  x  Tan-1  [  U  /  (2  x  R  x  Sint)  ]  (1.41) 
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The  fragment  spray  zone  covers  a  spherical  area  of: 


Area  =  b  x  R  x  {  4>2  -  <t>1  )  (1-42) 

Substituting  Equation  1.42  into  Eguation  1.33  yields: 

n  =  (N  x  b)  /  [2  x  tt  xRx  (Cos  4>i  -  Cos  4*2  )  ]  (1.43) 

which  determines  the  number  of  fragments  which  strike  the 
aircraft  in  zone  1.  The  assumption  has  been  made  in  this 
estimation  that  the  fragment  spray  covers  the  entire 
presented  area  of  the  aircraft.  If  this  is  not  the  case,  or 
if  only  a  portion  of  the  spray  meridian  hits  a  portion  of 
the  aircraft  (zones  2,  3,  and  4  in  Figure  1.11),  Ap  ,  in 
Equation  1.33  must  be  reduced  to  the  actual  area  that  is 
struck  by  fragments.  The  extent  of  the  fragment  spray  which 
does  strike  the  aircraft,  the  number  of  fragment  hits,  the 
fragment  approach  directions,  and  where  the  hits  occur  are 
dependent  upon  the  encounter  conditions.  For  example,  a 
detonation  directly  below  the  center  of  the  aircraft  in  a 
head-cn  encounter  will  have  a  different  result  than  from  a 
detonation  in  the  same  place  for  a  tail-chasing  missile  due 
to  the  difference  in  the  relative  closing  velocity. 
Furthermore,  changing  the  elevation  angle  of  the  missile  at 
the  time  of  detonation  will  change  the  results.  With  the 
number  of  fragments  which  strike  the  aircraft  determined, 
the  effects  of  fragments  aEd  penetrators  striking  an 
aircraft  will  be  examined  in  the  next  chapter. 
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II.  TARGET  IBINEHABILITY 


A.  IHTBCDOCTION 

Target  vulnerability  refers  to  the  inability  of  a  target 
to  withstand  one  or  more  hits  by  damage  mechanisms  (frag¬ 
ments,  penetrators,  incendiary  particles,  and  blast)  or  a 
target's  liability  to  serious  damage  or  destruction  when  hit 
by  enemy  fire.  Aircraft  that  are  more  vulnerable  are 
softer,  that  is,  they  are  more  likely  to  be  lost  when  hit. 
Therefore,  aircraft  vulnerability  is  essentially  a  measure 
of  the  toughness  of  an  aircraft  when  all  surviveability 
measures  have  failed  and  the  threat  interacts  with  the 
aircraft.  From  an  air  defense  standpoint  target  vulner¬ 
ability  is  good. 

Each  individual  component  cf  an  aircraft  has  a  certain 
level  or  amount  of  vulnerability.  Each  component's  vulner¬ 
ability  then  contributes,  in  seme  measure,  to  the  overall 
vulnerability  of  the  aircraft.  The  critical  components  of 
an  aircraft  are  those  components  that  are  essential  to  the 
functioning  of  a  system,  and  if  the  component  performance  is 
sufficiently  degraded  or  if  the  component  is  rendered  inop¬ 
erative  by  combat  damage,  a  target  kill  in  some  kill 
category  will  result.  The  systematic  description,  delin¬ 
eation,  and  quantification  of  the  vulnerability  of  the  indi¬ 
vidual  components  and  vulnerabi  lity  of  the  total  aircraft  is 
known  as  a  vulnerability  assessment. 

B.  IDENTIFICATIOH  OF  CBITICAL  COHPOBENTS 

The  first  step  in  a  vulnerability  assessment  is  the 
identification  of  those  compcrents  whose  damage  or  loss 
could  lead  to  an  aircraft  kill,  and  they  are  referred  to  as 


critical  components.  This  identification  process  is  called 
critical  component  analysis.  A  component  may  be  a  critical 
component  because  it  provides  an  essential  function  such  as 
thrust,  lift,  or  control.  A  component  may  also  be  a  crit¬ 
ical  component  because  its  mode  of  failure  leads  to  the 
failure  of  a  critical  component  that  does  provide  an  essen¬ 
tial  function.  For  example,  a  fuel  tank  in  a  wing  can  be 
perforated  by  a  fragment,  causirg  a  slow  fuel  leak  and  even¬ 
tual  fuel  depletion,  with  no  substantial  effect  on  the 
continued  operation  cf  the  aircraft.  In  this  situation,  the 
wing  fuel  tank  is  not  a  critical  component.  On  the  ether 
hand,  the  fragment  impact  and  penetration  of  the  wing  tank 
could  cause  ignition  cf  the  fuel  vapor  in  the  ullage,  with  a 
subseguent  fire  or  explosion  and  loss  of  the  aircraft.  In 
this  case,  the  wing  tank  is  definitely  a  critical  component. 

A  general  procedure  has  been  developed  for  determining 
the  critical  components,  their  possible  damage  or  failure 
modes,  and  the  effects  of  the  component  damage  or  failure 
upon  the  continued  operation  cf  the  aircraft.  This  proce¬ 
dure  consists  of:  (1)  a  selection  of  the  aircraft  kill 
levels  or  categories  to  be  considered,  (2)  an  assembly  of 
the  technical  and  functional  description  of  the  aircraft, 
and  (3)  the  determination  of  the  critical  components  of  the 
aircraft  and  their  damage-caused  failure  modes  for  the 
selected  kill  levels. 

1 .  Aircraft  Kill  Levels 

To  assess  the  vulnerability  of  both  fixed  wing  and 
rotary  aircraft  in-flight,  four  kill  categories  have  been 
defined.  These  kill  categories  are  the  Attrition  Kill,  the 
Mission  (Mission  Abort)  Kill,  the  Forced  Landing  Kill,  and 
the  Mission  Available  Kill. 
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a.  Attrition  Kill 

Attrition  kill  covers  those  aircraft  with  combat 
damage  so  extensive  that  it  is  neither  reasonable  nor 
economical  to  repair.  The  attrition  category  is  divided 
into  the  six  levels  cf  kill  listed  below. 

(1)  KK  Kill.  This  level  of  kill  is  associated 
with  damage  that  will  cause  the  aircraft  to  disintegrate 
immediately  upon  being  hit.  This  kill  level  is  also 
referred  to  as  a  Catastrophic  Kill. 

(2)  K  Kill.  This  level  of  kill  is  associated 
with  damage  that  will  cause  an  aircraft  to  fall  out  of 
manned  control  within  30  seconds  after  being  hit. 

(3)  A  Kill.  This  level  of  kill  is  associated 
with  damage  that  will  cause  an  aircraft  to  fall  out  of 
manned  control  within  five  minutes  after  being  hit. 

(4)  B  Kill.  This  level  of  kill  is  associated 
with  damage  that  will  cause  an  aircraft  to  fall  out  of 
manned  control  within  30  minutes  after  being  hit. 

(5)  C  Kill.  This  level  of  kill  is  associated 
with  damage  that  will  cause  an  aircraft  to  fall  out  of 
manned  control  before  completeing  its  mission. 

(6)  E  Kill.  This  level  of  kill  is  associated 
with  damage  that  will  cause  an  aircraft  to  sustain  addi¬ 
tional  levels  of  damage  upon  landing  and  makes  it  uneconom¬ 
ical  to  repair  as  specified  by  the  applicable  Technical 
Orders,  Technical  Bulletins,  anc  regulations. 

b.  Mission  (Mission  Abort)  Kill 

This  category  covers  any  aircraft  with  combat 
damage  that  prevents  the  aircraft  from  completing  its 
mission.  This  is  mission  dependent  and  is  divided  into  two 
levels;  mission  abort  and  mission  kill.  Mission  abort 
covers  aircraft  which  are  net  dost  to  inventory  but  cannot 
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complete  their  mission.  Missicn  kill  covers  aircraft  which 
fall  cut  of  manned  control  before  completing  their  mission. 

c.  Forced  landing  Kill 

This  category  covers  those  aircraft  with  ccmhat 
damage  that  forces  the  crew  to  execute  a  controlled  landing 
(powered  or  unpowered).  This  category  includes  aircraft 
with  damage  which  will  reguire  repairs  for  flight  tc  another 
area  and  aircraft  with  damage  which  cannot  be  repaired  on 
site  tut  which  can  te  recovered  by  a  special  team.  This 
category  has  been  restricted  mainly  to  rotary  wing  aircraft 
which  can  land  nearly  anywhere  either  powered  or  by  autoro¬ 
tation.  It  is  more  difficult  for  a  damaged  fixed  wing 
aircraft  to  successfully  execute  a  forced  landing  (and/or 
subsequent  takeoff)  since  some  prepared  landing  site  is 
generally  required. 

d.  Mission  Available  Kill 

This  category  covers  those  aircraft  that  have 
landed  with  combat  damage  and  will  require  repair  before 
returning  to  mission  ready  status.  There  are  different 
levels  (intervals)  for  missicn  availability.  The  interval 
of  time  reguired  to  accomplish  repairs  is  expressed  in 
elapsed  time,  total  man-hours,  or  combinations  thereof. 

2 •  Aircraft  Description 

At  the  beginning  of  any  vulnerability  study,  as  much 
as  possible  of  the  aircraft’s  technical  and  functional 
description  must  be  gathered  on  each  of  the  major  systems  of 
the  aircraft.  The  aircraft's  technical  description  consists 
of  engineering  data  which  documents  the  physical  and  func¬ 
tional  relationships  of  the  aircraft's  subsystems.  The 
types  of  physical  descriptions  utilized  are  general  aircraft 
arrangement  drawings  such  as  three  view  and  intoard 
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profiles,  installation  drawings,  and  schematic  diagrams  for 
the  primary  subsystems  to  include:  airframe  structure, 
propulsion  system,  fuel  system,  flight  control  system, 
pneumo-hydraulic  system,  aircrew,  avionics  system,  and 
weapon  and  delivery  systems.  The  suitability  and  guartity 
of  data  available  to  produce  the  necessary  aircraft 
descriptions  are  functions  of  the  status  of  the  system 
within  the  acquisition  or  deployment  phase.  Aircraft  tech¬ 
nical  descriptions  should  utilize  all  of  the  data  base  to 
include:  engineering  scaled  drawings,  subsystem  functional 
descriptions,  technical  orders  and  manuals,  and  access  to 
design  personnel. 

3.  Critical  Component  Analysis 

A  critical  component  is  any  component  that  is  essen¬ 
tial  to  the  functioning  of  a  system,  and  if  the  component 
performance  is  sufficiently  degraded  or  if  the  component  is 
rendered  inoperative  by  combat  damage,  a  target  kill  in  some 
kill  category  will  result.  For  example,  the  engine  in  a 
single  engine  aircraft  is  a  critical  component  for  an  A  kill 
because  its  loss  would  lead  to  an  aircraft  loss  within  five 
minutes. 

When  two  or  more  aircraft  components  are  redundant, 
such  as  two  engines,  the  loss  of  any  one  of  the  redundant 
components  will  not  result  in  the  loss  of  an  essential  func¬ 
tion  and  hence,  that  component  is  not  a  critical  component 
according  to  the  definition  given  above.  This  assumes  that 
the  damage  process  and  loss  of  one  redundant  component  will 
not  lead  to  the  loss  cf  any  other  redundant  components.  For 
example,  if  one  engine  of  a  t*in  engine  aircraft  starts  to 
burn,  the  assumption  is  made  that  the  fire  will  not  spread 
to  the  other  engine  and  destroy  it.  If  this  were  to  happen, 
there  is  no  actual  redundancy  a rd  both  engines  are  ncnredun- 
dant  critical  components.  Since  more  than  one  hit  can  be 
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expected  in  a  typical  threat  encounter,  it  is  possible  that 
all  of  the  redundant  components  could  be  killed,  leading  to 
an  aircraft  kill.  Therefore,  the  fact  that  a  component  is 
reduncant  does  not  eliminate  it  as  a  critical  component. 
This  reguires  that  a  distinction  between  the  two  kinds  of 
critical  components  be  made.  3n  the  past,  nonredunda.ot  and 
redundant  critical  components  have  been  referred  tc  as 
singly  vulnerable  components  and  multiply  vulnerable  compo¬ 
nents,  respectively.  This  terminology  is  confusing  and  will 
not  be  used  here.  A  given  component  may  be  nonredundant 
with  respect  to  a  given  kill  category  and  redundant  with 
respect  tc  another  kill  category.  For  example,  consider  a 
twin  engine  helicopter.  If  the  loss  of  either  engine  causes 
a  mission  abort,  the  engines  are  nonredundant  for  the 
mission  abort  category.  If  the  loss  of  both  engines  is 
required  to  cause  a  crash  or  forced  landing,  the  engines  are 
redundant  for  these  two  kill  categories. 

The  first  step  in  a  critical  component  analysis  is 
to  identify  the  flight  and  mission  essential  functions  that 
the  aircraft  must  perform  ir  order  to  accomplish  its 
mission.  The  second  step  is  the  identification  of  the  major 
systems  and  subsystems  that  perform  these  essential  func¬ 
tions.  The  third  step  is  tc  conduct  a  Failure  Mode  and 
Effects  Analysis  (FMEA)  to  identify  the  relationships 
between  each  possible  type  cf  individual  component  or 
subsystem  failure  mode  and  the  performance  of  the  essential 
functions.  The  Fault  Tree  Analysis  (FTA)  1  s  sometimes  used 
to  provide  additional  insight  into  the  identification  of 
critical  components.  The  fourth  step  is  to  conduct  a  Damage 
Modes  and  Effects  Analysis  (DMEA).  The  DMEA  relates  compo¬ 
nent  or  subsystem  failure  modes  to  combat-caused  damage. 
The  combination  of  the  third  and  fourth  steps  is  referred  to 
as  the  Failure  Mode,  Effects,  and  Criticality  Analysis 
(FMECA) .  The  last  step  in  a  critical  component  analysis  is 


39 


Fore  i-;n  Object  Ingestion.  Foreign  objects 
consist  cf  projectiles,  fragments,  a  '  pieces  of  damaged 
aircraft  components  which  enter  the  engine  inlet  ar.d  subseq¬ 
uent  ly  damage  the  far.  and  compressor  blades.  This  could 
cause  an  engine  failure  or  the  throwing  of  blades  through 
the  engine  case,  leading  to  additional  component  damage. 

Inlet  ^.±2*  Distortion.  Distortion  cf  air 
flow  to  the  engine  can  be  so  severe  as  a  result  cf  combat 
damage  to  the  inlet  that  uncontrollable  engine  surging  cr 
engine  failure  occurs. 

Lubrication  Starvation.  Penetrator,  frag¬ 
ment,  or  fire  damage  to  the  lubrication  circulation  and 
cooling  subsystem  can  result  in  loss  of  lubrication  and 
subsequent  deterioration  of  bearing  surfaces,  followed  by 
engine  inoperability.  Loss  of  lubrication  failures  are  most 
often  related  to  the  bearings,  where  loss  of  heat  removal 
eventually  results  in  bearing  seizure. 

Compressor  Case  Perforation  or  Distortion. 
This  kill  mode  is  caused  by  penetrator  or  fragment  penetra¬ 
tion  through  the  case,  by  distortion  of  the  case,  cr  by 
damaged  compressor  blades  exiting  through  the  case. 

Combustor  Case  Perforation .  Penetrator  or 
fragment  penetration  and  holing  of  the  combustor  case,  with 
subsequent  hot  gas  emission  or  torching  through  the  hole, 
can  cause  secondary  damage  effects,  such  as  severe  heating 
of  adjacent  fuel  tanks  or  control  rods,  and  can  also  cause  a 
combustion  pressure  drop  that  nay  result  in  a  significant 
loss  cf  engine  power. 

Tu rbine  Section  Failure.  Turbine  failure 
can  be  caused  by  penetrator  or  fragment  damage  to  the 
turbine  wheels,  blades,  and  case.  This  results  in  a  less  of 
engine  power  or  secondary  perforation  ar.d  possible  fire 
damage. 
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subsequently  ignited  tv  incendiary  particles,  by  hot  iretal 
surfaces,  or  by  the  hot  gases  from  punctured  bleed  air  lines 
cr  ermine  cases.  Fire  or  explosion  in  the  enclosed  spaces 
can  eventually  cause  significant  damage  to  nearby  subsystem 
components  and  structure  that  wculd  result  in  their  failure. 
The  generation  of  smcke  and  tcxic  fumes  may  also  occur  and 
migrate  to  crew  stations,  causing  a  possible  mission  abort, 
forced  landing,  or  aircraft  abardonment. 

Sustained  Exterior  Fuel  Fire.  This  kill 
mode  is  caused  by  carnage  to  fuel  tank  walls  resulting  in 
fuel  spillage  onto  the  exterior  of  the  aircraft  which  is 
subsequently  ignited,  producing  a  sustained  fire.  Sometimes 
the  exterior  fire  is  snuffed  cut  by  the  airflow  over  the 
surface;  however,  the  condi tier  of  the  damaged  surface,  the 
altitude,  and  the  flight  speed  may  prevent  this  from 
cccur  ing . 

HlllMllc  Ram.  Damage  to  container  walls 
cr  components  within  the  container  caused  by  the  intense 
pressure  waves  generated  in  the  contained  liquid  by  penetra- 
tors  cr  fragments  passing  through  the  liquid  is  referred  to 
as  hydraulic  ram  damage.  The  fluid  pressure  can  cause  large 
cracks  and  gaping  holes  in  the  container  walls,  leading  to 
excessive  leakage  either  externally  or  internally  into  dry 
bays,  engine  inlets,  etc.. 

(2)  Propulsion  System  Kill  lodes.  The 
following  kill  modes  of  the  propulsion  system  have  been 
observed . 

Fuel  Inqesti c  t.  Fuel  ingestion  is  caused 
by  fuel  entering  the  engine  air  inlet  following  rupture  of 
walls  that  are  common  to  both  a  fuel  tank  and  the  inlet. 
Fuel  ingestion  effects  normally  include  compressor  surge, 
severe  stall,  unstable  burning  in  the  tail  pipe,  and/or 
engine  flameout. 
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There  are  many  different  kinds  of  damage-caused 
failures  or  kill  modes  that  can  occur  within  each  of  the 
systems  cf  an  aircraft.  Failure  modes  for  an  aircraft  are 
the  various  ways  in  which  the  aircraft  can  fail  to  he  main¬ 
tained  in  the  required  mode  of  flight  or  fail  to  perform  its 
mission.  These  failure  modes  are  constituted  by  the  less 
of,  or  serious  degradation  of,  structural  integrity,  power, 
flight  control  or  mission  required  equipment,  or  lift. 
Failure  modes  are  established  for  a  given  aircraft  and 
mission  with  respect  to  pre es t ablished  minimum  requirements 
for  performance  of  the  aircraft  and  are  related  to  the  crit¬ 
ical  components  of  the  aircraft.  Some  of  the  most  important 
ones  are  listed  in  Tahle  1  and  described  below.  The  order 
of  the  systems  listed  is  indicative  of  their  contribution  to 
the  total  aircraft  vulnerability. 

(1)  Fuel  System  Kill  Modes.  The  following  is 
a  listing  and  brief  description  of  the  potential  fuel  system 
kill  modes. 

Fuel  Supply  Depletion.  This  kill  mode  is 
caused  either  by  damage  to  fuel  storage  components  that 
results  in  excessive  leakage  leading  to  a  significant  reduc¬ 
tion  in  the  amount  of  fuel  available  for  aircraft  operation, 
or  by  damage  to  fuel  pumping  and  transfer  systems  that 
prevents  fuel  from  reaching  the  engine (s). 

In-Tank  Fire  and  Explosion.  Fire  and 
explosion  can  be  caused  by  the  ignition  of  the  fuel-air 
mixture  in  the  ullage  by  incendiary  particles  or  by  a  hot 
tank  wall.  The  in-tank  fire  or  explosion  can  cause  substan¬ 
tial  damage  to  the  tankage  and  adjacent  structure  and  compo¬ 
nents,  and  the  fire  may  quickly  spread  to  other  parts  of  the 
aircraft . 

Void  Space  Fire  and  Explosion  -  This  can 
be  caused  by  fuel  leakage  into  void  spaces  or  dry  bays 
(adjacent  to  punctured  fuel  tanks  and  lines)  that  is 
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Sample  Disablement  Diagram 


(LIGHT  CONTROLS  (MECHANICAL) 
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Figure  2.5  &  Sample  DHEA  Matrix 


d.  Damage  Mode  and  Effects  Analysis  (DMEA) 

In  the  FMEA  the  cause  of  the  component  failure 
is  not  stipulated.  The  failure  may  or  may  not  be  related  to 
combat  damage.  When  specific  component  failures  due  to 
combat  damage,  such  as  mechanical  damage  to  components 
caused  by  projectile  or  fragment  penetration  or  damage 
caused  by  a  fire  or  explosion,  are  identified  and  examined, 
the  analysis  is  referred  to  as  a  DMEA.  In  the  DMEA,  the 
potential  component  or  subsystem  failures  identified  in  the 
TMEA,  as  well  as  other  possible  damage-caused  failures,  are 
associated  with  the  damage  mechanisms  and  the  damage 
processes.  These  failures  are  then  evaluated  to  determine 
their  relationship  tc  the  selected  kill  level.  The  quanti¬ 
fication  of  the  component  kill  criteria  is  also  part  cf  the 
DMEA,  but  this  procedure  is  described  in  the  vulnerability 
assessment  presentation.  The  possibility  of  any  secondary 
hazard  that  may  be  caused  by  the  primary  damage  processes  is 
also  identified  in  the  DMEA.  Examples  of  secondary  hazards 
are:  ingestion  of  fuel  by  an  engine,  and  seepage  cf  toxic 
fumes  from  a  fire  into  the  cockpit.  The  DMEA  is  referred  to 
as  the  criticality  analysis  of  the  FMECA . 

The  output  of  the  E  REA  can  take  many  forms.  The 
EMEA  matrix  is  similar  to  the  IMEA  summary  format  shewn  in 
Figure  2.4  in  which  the  components  and  their  damage-caused 
failure  modes  are  related  to  the  kill  level  or  category. 
Component  redundancy  relationships  and  the  appropriate 
component  kill  criteria  should  also  be  indicated  in  the 
matrix.  A  sample  EMEA  matrix  is  given  in  Figure  2.5.  A 
disablement  diagram  can  add  to  the  understanding  of  the  DMEA 
matrix  by  graphically  showing  the  locations  of  the  compo¬ 
nents  and  stating  the  effects  cf  component  kills.  A  sample 
disablement  diagram  is  presented  in  Figure  2.6. 
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Figure  2.4  Sanple  FMEA  Summary  Foriat 


determination  of  the  major  structural  or  aerodynamic  damage 
tolerances  is  also  performed  during  the  FSEA.  In  addition, 
the  effects  of  loss  cr  major  damage  to  aerodynamic  surfaces 
on  stability  and  control  of  the  aircraft  are  required-  Data 
generated  should  define  the  threshold  for  aerodynamic, 
structural,  and  control  limits  that  can  be  tolerated  for 
various  flight  conditions.  A  sample  summary  format  for  a 
FMEA  for  two  flight  control  roc  failure  modes  is  given  in 
Figure  2.4.  Note  in  Figure  2.4  that  the  control  rod  is  a 
critical  component  for  an  attrition  kill  when  it  jams,  tut 
not  when  is  is  severed. 

The  FMEA  is  applicable  to  both  single  component 
failures  and  multiple  competent  failures.  it  is  extremely 
important  to  consider  multiple  component  failures,  when  the 
failure  is  due  to  combat  damage,  because  of  the  likelihood 
that  mare  than  one  component  is  damaged  when  the  aircraft  is 
hit . 

The  effects  of  a  component  failure  should  also 
include  the  consideration  of  atj  transients  that  might  occur 
when  the  failure  occurs.  For  example,  consider  a  single 
engine,  fly-by-wire,  statically  unsTable  aircraft  with  no 
mechanical  flight  controls  as  tack-up.  Suppose  the  engine- 
driven  generator  that  supplies  the  electrical  power  to  the 
flight  control  computer  was  to  immediately  cease  operation 
and  that  the  computer  relies  on  an  emergency  ram-air  turbine 
(HAT)  for  hack  up  electrical  power.  The  RAT  is  designed  to 
he  deployed  into  the  airstream  when  the  electrical  power 
failure  is  sensed.  However,  this  deployment  takes  time, 
during  which  the  computer  could  be  without  sufficient  power. 
This  lack  of  power  could  cause  problems  with  the  fly-by-wire 
control  system  such  as  the  loss  of  the  SAS  or  the  issuance 
of  hardover  commands  to  the  ccntrol  surfaces  which  could 
cause  the  aircraft  tc  become  u rcontrollable,  leading  to  an 
aircraft  loss.  Thus,  the  assumption  of  redundancy  in  the 
electrical  power  system  is  errereous. 


Subsystem  function 
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Figure  2.3  Subsystem  Functions- 
Essential  Function  Relationships 


The  types  of  component  failure  modes  generally 
considered  in  the  FMEA  include  premature  operation,  failure 
to  operate,  failure  during  operation,  failure  to  cease  oper¬ 
ation,  and  degraded  or  out - cf-tolerance  operation.  A 
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Figure  2.2  Sy sten-Essential  Function  Relationships 
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Essential  Functions  and  Hission  Phases 
r  an  Attack  Helicopter 


These  include  special  functions  such  as  those  required  for 
the  vertical  flight  cf  a  VTOL  aircraft  or  those  required  for 
arrested  landing  aboard  an  aircraft  carrier.  A.  chart  iden¬ 
tifying  some  flight  ard  mission  essential  functions  and  seme 
of  the  mission  phases  for  an  attack  helicopter  is  given  in 
figure  2.1. 

t.  System-Essential  Functions  Relationships 

The  ability  of  an  aircraft  to  fly  and  to  conduct 
its  mission  depends  upon  the  continued  operation  of  those 
systems  and  subsystems  that  perform  the  essential  functions. 
If  the  aircraft  is  damaged  ir  combat,  the  operation  of 
certain  subsystem  components  may  be  impaired  or  the  compo¬ 
nent  may  cease  to  operate,  and  some  essential  functions  may 
be  lost.  The  severity  and  rapidity  with  which  the  less  of 
essential  functions  cccur  is  directly  related  to  the  kill 
levels. 

A  general  examination  of  each  aircraft's  systems 
and  subsystems  must  be  conducted  to  determine  its  specific 
contribution  to  the  essential  functions  identified  in  the 
previous  step.  Figure  2.2  presents  a  sample  tabulation  of 
those  systems  and  subsystems  that  contribute  to  the  essen¬ 
tial  functions  shown  in  Figure  2.1.  A  more  detailed  example 
of  the  relationship  between  the  functions  performed  by  one 
specific  subsystem  and  the  essential  functions  is  shewn  in 
Figure  2.3. 

c.  Failure  Mode  and  Effects  Analysis  (FMEA) 

The  Failure  Mode  and  Effects  Analysis  is  a 
procedure  that:  (1)  identifies  and  documents  all  possible 
failure  modes  of  a  component  or  subsystem,  and  (2)  deter¬ 
mines  the  effects  of  each  failure  mode  upon  the  capability 
of  the  system  and/or  subsystem  to  perform  its  essential 
functions.  The  FMEA  process  and  requirements  are  defined  in 
MIL-STD-785  and  MIL- STD- 1 62 9A. 
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a  visual  presentation  of  the  list  of  critical  components 
and/or  a  logical  expression  to  identify  the  redundant  and 
nonredundant  critical  components  for  the  selected  kill 
level.  The  visual  presentation  is  referred  to  as  a  kill 
tree  and  the  logical  expression  is  referred  tc  as  a  kill 
expression. 

a.  Flight  and  Mission  Essential  Functions 

Flight  essential  functions  are  those  system  and 
subsystem  functions  required  to  enable  an  aircraft  to 
sustain  controlled  flight.  Mission  essential  functions  are 
those  system  and  subsystem  functions  required  to  enable  an 
aircraft  to  perform  its  designated  mission.  The  analysis 
should  consider  each  phase  cf  the  mission.  A  typical 
mission  for  an  attack  aircraft  would  include  such  phases  as 
takeoff,  climb  to  cruise  altitude,  cruise  to  attack  area, 
descent  tc  attack  altitude,  target  location,  ordnance 
delivery,  egress  from  the  target  area,  climb  to  cruise  alti¬ 
tude,  return  cruise,  descent,  and  landing.  The  flight  and 
mission  essential  functions  should  be  identified  and  the 
priority  for  possible  protection  established  for  each  of 
these  phases.  For  example,  the  operation  of  the  electronic 
weapors  computer  during  takeoff  is  not  a  flight  essential 
function,  but  it  is  a  mission  essential  function  during 
ordnance  delivery.  A  particular  level  of  operation  should 
be  identified  for  the  flight  essential  functions  such  as 
lift,  thrust,  and  control.  For  example,  loss  of  one  engine 
of  a  twin  engine  helicopter  may  not  cause  a  total  less  of 
lift  and  thrust,  but  it  will  lead  to  a  reduction  of  perform¬ 
ance  capabilities.  This  loss  of  performance  may  not  be 
acceptable  in  a  hostile  environment  because  the  helicopter 
would  become  an  easy  target.  Therefore,  the  continued  oper¬ 
ation  of  both  engines  may  be  required  to  prevent  an  attri¬ 
tion  kill.  Special  functions  must  also  be  identified. 
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Exhaust  Duct  Failure.  Penetration  by 
penetratcrs  and  fragments  into  the  exhaust  duct  may  result 
in  damage  to  nozzle  control  lines  and  actuator  mechanisms 
and  possible  fuel  spillage  and  secondary  fire  if  an 
augmentor  is  operating  at  the  time  of  the  hit. 

Engine  Controls  and  Accessories  Failure. 
A  kill  cf  the  controls  and  accessories  can  be  caused  by 
penetratcr,  fragment,  or  fire  damage.  The  result  can  be 
loss  of  control  of  the  engine  cr  loss  of  one  of  the  impor¬ 
tant  accessories. 

(3)  Flight  Control  System  Kill  Modes .  Some 
possible  flight  control  kill  modes  are  listed  below. 

Disruption  cf  Control  Signal  Path. 
Severence  or  jamming  of  the  mechanical  or  electrical  path 
that  transmits  the  control  signals  from  the  pilot  to  the 
control  surfaces  or  the  actuators  can  partially  cr  totally 
incapacitate  the  control  system. 

Loss  of  Control  Power.  Control  power  can 
be  lest  as  a  result  of  damage  to  hydraulic  power  components 
which  causes  a  loss  cf  hydraulic  pressure.  Types  cf  power 
system  damage  are  thermal  degradation  due  to  fire,  perfora¬ 
tion  of  hydraulic  reservoirs,  cylinders,  or  lines  leading  to 
a  loss  cf  hydraulic  fluid,  ard  deformation  of  hydraulic 
components,  actuators,  or  lines  that  cause  a  hydraulic  lock 
cr  jammed  condition. 

Loss  of  Aircraft  Motion  Data.  Damage  to 
the  aircraft  motion  sensors  ci  to  the  sensor  data  signal 
paths  to  the  flight  control  ccnputer  can  prevent  the  auto¬ 
pilot  and  tne  stability  augmentation  system  from  properly 
controlling  the  moticn  of  the  aircraft.  The  results  can 
vary  frem  a  partial  loss  of  control,  leading  to  a  mission 
abort,  to  the  loss  cf  an  out- cf-control  aircraft.  Ihese 
components  are  relatively  soft  and  are  easily  damaged  or 
severed  by  penetrators,  fragments,  and  fire. 
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Damage  to  Control  Surfaces  and  Hinges. 
Penetrators,  fragments,  blast,  and  fire  damage  can  result  in 
the  physical  removal  of  a  portion  or  all  of  a  flight  control 
surface  cr  in  the  jamming  of  the  hinges,  rods,  and  ether 
linkages  between  the  se r vea ctua tors  and  the  control 
surfaces . 

Hy draulic  Fluid  Fire.  Fires  can  result 
from  the  ignition  of  pressurized  or  gravity-leaked  hydraulic 
fluid,  and  smoke  or  tcxic  fumes  from  the  fire  can  affect  the 
crew . 

(4)  Power  Train  and  Ro  tor  Blade/Propeller 
System  Kill  Modes.  Some  of  the  possible  kill 
modes  within  the  power  train  and  rotor  blade  system  of  heli¬ 
copters  and  propeller  driver  fixed-wing  aircraft  are 
described  below. 

Loss  of  Lubrication.  This  kill  mode  can 
occur  due  to  projectile  or  fragment  perforation  cf  oil  or 
grease  containing  components,  with  subsequent  loss  of  lubri¬ 
cation  oil  or  grease.  Lubrication  starvation  is  especially 
critical  in  oil-cooled  helicopter  transmissions,  where  the 
oil  systems  are  not  self-contained  and  usually  consist  of 
externally  mounted  components,  such  as  sumps,  filters, 
coolers,  and  interconnecting  lines  and  hoses.  Loss  of 
lubrication  prevents  the  removal  of  heat  and  lubrication  cf 
rubbing  surfaces,  which  eventually  results  in  component 
seizure.  In  helicopter  transmissions  and  gear  boxes,  fail¬ 
ures  are  often  catastrophic,  causing  case  rupture  and  fire 
after  input  pinion  failures  and  rotor  blade  seizure  after 
planetary  assembly  failures. 

Mechanical/Structural  Damage.  Mechanical 
or  structural  failure  of  power  train  components  can  be 
caused  by  fragment  and  penetratcr  inpact  or  penetration,  or 
by  fire.  Bearings,  gears,  atd  shafts  are  prone  to  damage 
and  failure  when  hit,  shafts  can  be  severed,  and  bearings 
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and  gears  can  jam.  Chips  and  debris  from  damaged  components 
or  structure  can  jam  the  oil  pump,  causing  loss  of  lubrica¬ 
tion.  Rotor  blades  and  propellers  when  hit  can  result  in 
rotor  unbalance,  blade  instability,  blade  out-of-track,  and 
loss  cf  lift.  Rotor  unbalance  is  perhaps  the  most  critical 
conseguence  of  ballistic  damage  and  occurs  when  a  portion  of 
the  blade  is  removed.  This  less  of  mass  in  one  blade  can 
cause  large,  alternating  hub  fcrces  and  intense  cockpit  and 
control  vibrations,  leading  to  structural  failure  or  loss  of 
control.  Blade  instability  is  caused  by  a  reduction  of 
blade  stiffness  due  to  damage  and  can  result  in  severe 
flutter  cr  divergent  pitch  oscillation  that  can  be  cata¬ 
strophic.  Blade  out-of-track  is  usually  a  less  severe 
result  cf  the  reduction  of  blade  stiffness,  but  it  could 
result  in  blade  contact  with  the  fuselage.  Although  sene 
loss  of  lift  normally  accompanies  any  ballistic  damage,  the 
conseguences  are  usually  not  as  catastrophic  as  those  asso¬ 
ciated  with  the  other  types  of  blade  reactions. 

(5)  Crew  System  Kill  lodes.  The  inability  of 
the  pilot  and  his  or  her  replacement  to  operate  the  aircraft 
because  cf  injury,  incapacitation,  or  death  will  usually 
lead  to  an  aircraft  kill  in  a  very  short  period  of  time. 

(6)  Structural  System  Kill  Modes.  The  struc¬ 
tural  system  is  usually  the  toughest  system  on  the  aircraft. 
However,  structural  damage  car  be  sufficient  to  cause  an 
aircraft  kill.  Some  possible  structural  kill  modes  are 
listed  below. 

Structure  Removal.  Physical  severence  or 
complete  loss  of  large  portions  of  the  load-carrying 
aircraft  structure  caused  by  multiple  penetrators  and  frag¬ 
ments,  blast,  fire,  or  radiation  effects  can  result  in 
either  an  immediate  ct  a  delayed  aircraft  loss. 

E£§~sure  Overload.  Immediate  failure  or 
subsequent  failure  under  maneuver  loads  can  be  caused  by 


external  tlast  effects  which  result  in  over-stressing  the 
load  carrying  structure. 

Thermal  Wea.ke1n.n3.  Structural  failure  can 
occur  to  portions  of  the  load-carrying  structure  as  a  result 
of  internal  void  space  fires,  esternally  sustained  fires,  or 
radiation  over  a  portion  of  the  aircraft  surface. 

Penetration.  A  single  penetration  of  one 
load-carrying  member  will  usually  not  cause  structural 
failure;  several  members  must  be  penetrated  or  cut  before 
failure  can  occur.  Since  the  likelihood  of  structural 
failure  from  penetration  by  a  few  fragments  cr  armor- 
piercing  projectiles  is  extremely  small,  this  type  of 
failure  would  most  likely  result  from  continuous  rod  warhead 
effects. 

(?)  Electrical  Power  System  Kill  Modes.  The 
failure  of  electrical  system  components  is  due  to  the 
severing  or  grounding  of  electrical  circuits,  the  de  truc- 
tion  cr  unbalancing  of  rotating  components,  such  as  genera¬ 
tors  and  alternators,  and  the  penetration  or  overheating  of 
batteries. 

(8)  Armament  System  Kill  Modes.  Two  major 
reactions  can  occur  when  gun  ammunition,  bombs,  rockets,  and 
missiles  are  hit  by  a  damage  mechanism.  One  is  a  sustained 
fire  in  the  magazine  that  could  cause  cook-off  or  detonation 
of  the  stored  ammunition,  and  the  other  is  a  severe  explo¬ 
sion  of  either  the  armament  or  the  propellant. 

(9)  Avionics  System  Kill  Modes.  Avionics 
components  are  usually  very  soft  and  are  easily  damaged  by 
penetrators  and  fragments,  blast,  radiation,  and  thermal 
hazards,  such  as  fire  or  hot  gas  torching.  Their  kill  mode 
is  usually  failure  to  operate,  although  a  degraded  operation 
is  possible. 
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e. 


Fault  Tree  Analysis  (FT A) 


As  described  in  the  preceding  section,  the  FMEA 
is  a  tottom-up  approach  to  determine  an  aircraft's  critical 
components.  In  the  FMEA,  the  failure  of  a  component  is 
assumed  and  the  consequences  of  that  failure  are  identified. 
Another  procedure  for  identifyirg  critical  components  is  the 
Fault  Tree  Analysis.  The  FTA  is  a  top-down  approach  which 
starts  with  an  undesired  event  and  then  determines  what 
event  or  combination  of  events  can  cause  the  undesired 
event.  The  Fault  Tree  Analysis  is  one  of  the  principal 
methods  of  system  safety  analysis,  and  can  include  both 
hardware  failures  and  human  effects.  The  generic  fault  tree 
diagram  shewn  in  Figure  2.7  demonstrates  the  logic  symbology 
used  in  the  Fault  Tree  Analysis. 

The  undesired  event  0  can  only  occur  when  event 
A  and  event  B  occurs.  (This  is  the  logical  AND  gate) .  Event 
A  can  occur  when  event  C  or  evert  D  occurs,  or  if  both  event 
C  and  event  D  occurs.  (This  is  the  inclusive  OR  gate)  . 
Event  B  can  occur  when  event  E  or  event  F  occurs,  but  rot 
when  both  event  E  and  event  F  occurs.  (This  is  the  exclusive 
CR  gate) .  Because  the  undesired  events  of  interest  here  are 
failures  caused  by  damage,  the  FTA  will  be  referred  to  as 
the  Damage  Tree  Analysis. 

A  portion  of  a  damage  tree  diagram  for  a  twin- 
engine  aircraft  with  a  single  fuel  supply  source  to  both 
engines  is  illustrated  in  Figure  2.8c.  The  undesired  event 
is  an  aircraft  attrition  kill.  An  attrition  kill  occurs  if 
the  aircraft  can  neither  fly  nor  land.  The  aircraft  cannot 
fly  if  it  loses  lift,  or  thrust,  or  control.  Loss  of  thrust 
will  occur  when  both  engines  fail  or  when  the  common  fuel 
supply  tc  both  engines  fails.  leakage  from  damage  caused  by 
penetration  or  hydraulic  ram  from  the  feed  tank  that 
supplies  fuel  to  both  engines  will  cause  the  fuel  system  to 
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Figure  2.7  A  Generic  Fault  Tree  Diagram 

fail.  The  left  ecgine  can  fail  due  to  engine  damage  or  the 
loss  cf  the  left  engine  fuel  supply.  The  left  engine  fuel 
supply  system  can  fail  due  to  penetration  of  many  cf  the 
fuel  transfer  components  from  the  feed  tanks  to  the  engine 
combustor,  or  these  components  can  fail  due  to  fire  caused 
ty  leaking  fuel,  leaking  hydraulic  fluid,  or  a  holed  combu¬ 
stor.  The  left  engine  can  fail  due  to  damage  caused  ty  fuel 
ingestion,  penetration  of  the  engine  compressor,  combustor. 
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Figure  2.8b  Portion  of  a  Damage  Tree  Diagram  CoDt'd 


Figure  2.8c  Portion  of  a  Damage  Tree  Diagram  Cont'd 

and  selected  kill  le7el.  Each  critical  component  either 
makes  a  singular  contribution  to  an  essential  function  or 
each  component  is  one  of  two  or  more  redundant  components, 
each  of  which  can  make  the  necessary  contribution.  The 
distinction  between  nonredundant  critical  components  and 
redundant  critical  components  is  extremely  important  and 
will  te  demonstrated  in  the  following  sections. 
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(1)  Typical  Critical  Components.  For  a  two 
engine,  single  pilot  helicopter,  the  following  nonredundant 
components  are  potential  critical  components  for  an  attri¬ 
tion  kill:  (1)  Flight  control  system  components  (reds,  rod 
ends,  bellcranks,  pitch  links,  swashplate,  hydraulic  actua¬ 
tors,  collective  lever,  and  control  pedals),  (2)  Kotor 
tlade  and  power  train  components  (blades,  drive  shafts, 
rotor  heads,  main  transmission,  and  gear  boxes),  (3)  Fuel 
system  components  (fuel  cells,  the  sump,  lines,  and  valves)  , 
(4)  Pilot,  and  (5)  Tail  boom. 

The  following  redundant  components  are 
potential  critical  components  for  an  attrition  kill:  (1) 
Propulsion  system  components  (engine  and  engine  mounts), 

(2)  Hydraulic  subsystem  compcrents,  and  (3)  Structural 
elements. 

For  a  single  engine,  single  pilot,  fixed- 
wing  aircraft,  some  potential  redundant  and  nonredundant 
critical  components  are:  (1)  Pilot,  (2)  Flight  controls  in 
the  ccckpit  and  the  pitch  axis  flight  control  components, 

(3)  Hydraulic  reservoirs,  high-pressure  lines,  components 
and  actuators,  (4)  All  fuel  tanks,  components,  lines,  and 
shut-eff  valves,  (5)  Engine  far,  compressor,  turbine,  and 
combustor  sections,  drive  shaft  and  bearings,  engine  mounts, 
and  the  lubrication  and  fuel  supply  components,  (6)  Major 
structure,  such  as  wirg  box  spars,  fuselage  longerons,  and 
the  horizontal  and  vertical  stabilizer  spars  and  attach¬ 
ments,  (7)  External  ordnance  and  the  ammunition  storage 
drum,  (8)  Liquid  oxygen  (LOX)  bottle  and  components,  and 
(9)  Liquid-cooled  avicnics  with  a  flammable  coolant. 

(2)  The  Kill  Tree.  A  visual  illustration  of 
the  critical  components  and  of  the  contribution  of  component 
redundancy  is  provided  by  the  kill  tree.  In  order  to  kill 
the  aircraft  a  complete  cut  through  the  tree  trunk  is 
required.  A  sample  kill  tree  for  a  two  engine,  two  pilot 
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helicopter  is  shown  ir  Figure  2.9.  For  example,  according 
to  the  kill  tree  in  Figure  2.?,  a  loss  of  the  pilot  and 
either  the  co-pilot  cr  the  co-pilot's  controls  will  lead  to 
an  aircraft  kill,  as  will  a  less  of  the  drive  train  cr  loss 
cf  fuel  feed. 

(3)  The  Kill  Expression.  The  relationship 
tetween  component  loss  and  an  aircraft  kill  can  be  expressed 
using  the  logical  AKD  and  OB  statements-  This  logical 
expression  is  called  the  kill  expression.  As  an  example,  a 
portion  of  the  kill  expression  for  the  kill  tree  depicted  in 
Figure  2-9  is  given  by: 

[  (Pilot  -OR.  Pilot  Controls)  -AND.  (Copilot 

-0E.  Copilot  Controls)  ]  -OR.  (Engine  1  -AND. 

-OR.  (Drive  Train)  -CF.  etc. 

C.  V DINER ABILITY  ASSESSMENT 

1 .  Defining  a  V ulnerabilit  y  Assessment 

A  vulnerability  assessment  is  the  process  of  deter¬ 
mining  numerical  values  for  the  measures  of  vulnerability. 
Target  vulnerability  analysis  is  a  scientific  discipline 

involving  both  experimental  and  analytical  processes. 

Preliminary  theories  which  attempt  to  describe  the  response 
of  a  target  to  a  particular  threat  is  accomplished  during 
the  analysis.  Experimentation  provides  the  data  used  to 
corroborate  or  repudiate  the  theories  developed  during  anal¬ 
ysis.  Target  vulnerability  concepts  are  based  or  funda¬ 
mental  physical  principles.  These  principles  include  the 

theory  cf:  hydraulic  ram,  ignition,  crack  propagation, 

engine  response  to  fuel  ingestion,  and  structural  response 
to  blast  and  penetration.  Vulnerability  assessments  may  be 
carried  out  entirely  "by  hand",  or  one  or  more  computer 
programs  may  be  used.  Assessments  are  usually  conducted  to 
help  the  designer  evaluate  the  vulnerability  of  a  design,  or 
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ure  2.9  Sample  Kill  Tree  for  a  Two 
Engine  Two  Pilot  Relicopter 


more  importantly,  by  the  military  to  predict  the  response  of 
targets  to  a  particular  threat  before  threat  and  target 
engagement. 

A  vulnerability  assessment  is  carried  out  at  one  of 
three  general  levels  cf  detail.  These  levels  are  estimates, 
evaluations,  and  analyses.  Best  assessments  consider  five 
fragment  impact  velocities  fren  1000  to  10,000  ft/sec  and 
use  as  a  minimum,  the  six  cardinal  aspects.  For  a  minimum 
level  assessment,  the  six  major  aspects  shown  in  Figure  2.10 
are  usually  considered  for  each  kill  level.  The  26  aspects 
depicted  in  Figure  2.11  are  usually  considered  when  a  mere 
detailed  analysis  or  a  computer  analysis  is  performed. 
Estimates  typically  use  simple  equations  for  the  aircraft 
vulnerability  measures  that  are  functions  of  a  few  major 
parameters.  These  equations  are  referred  to  as  regression 
equations  if  they  are  fitted  tc  historical  data  on  several 
aircraft  or  to  the  results  from  engineering  studies. 
Evaluations  are  more  detailed  than  estimates  and  may  include 
such  items  as  the  individual  component  locations,  sizes,  and 
vulnerability  measures.  Analyses  are  very  detailed  assess¬ 
ment  studies  that  use  specific  technical  and  functional 
information  about  the  components  and  their  vulnerability. 
Analyses  are  usually  conducted  on  a  digital  computer  using 
complex  geometric  target  models. 

2 •  Vulnerabilit  v  Measures 

Because  of  the  diverse  nature  of  the  hostile  envi¬ 
ronment  in  which  aircraft  operate,  the  measures  of  the 
vulnerability  of  an  aircraft  vary  with  the  type  of  threat 
encountered.  For  example,  if  a  hit  on  the  aircraft  must 
occur  in  order  for  a  threat  to  he  effective,  such  as  a  small 
arms  projectile  and  a  contact- fuzed  high  explosive  warhead, 
one  measure  of  vulnerability  is  the  conditional  probability 
the  aircraft  is  killed  given  a  random  hit  on  the  aircraft. 
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gure  2-10  Six  Aircraft  Aspects  for  a  Minimum  Assessment 


The  numerical  value  for  PWI)  depends  upon  the 

'  1 

presentee  area  of  the  critical  component,  Ac.  ,  ar.d  of  the 
aircraft,  AP ,  and  upon  the  component  kill  criterion,  . 
"he  presented  area  of  the  critical  components  and  of  the 
aircraft  can  be  obtained  from  the  available  techrical 
description  of  the  aircraft.  The  procedure  for  determining 
the  numerical  value  for  Pk ,  is  described  in  the  presenta¬ 
tion  cn  the  critical  component  kill  criteria  given  above. 

In  this  assessment,  a  component  is  assumed  to  be 
either  operating  and  performing  all  of  its  functions  or 
killed.  No  degradation  of  component  capabilities  is  consid¬ 
ered  due  to  a  hit,  and  no  compounding  of  component  damage  is 
recognized.  Although  these  assumptions  are  usually  made  ir. 
a  vulnerability  assessment,  they  are  not  necessary. 
Theoretically,  only  the  component  hit  can  be  killed. 
Although  the  kill  of  adjacent  components,  perhaps  by  fire  or 
explosion,  is  not  directly  considered  here,  a  procedure  for 
indirectly  accounting  for  kills  of  adjacent  components  will 
be  described  later. 

Now  that  the  concepts  of  vulnerable  area  and  the 
probability  of  kill  given  a  hit  have  beer,  explained,  the 
scenario  must  be  considered.  In  any  given  combat  engage¬ 
ment,  the  aircraft  will  either  not  be  hit,  it  will  be  hit 
only  once,  or  the  aircraft  will  be  hit  more  than  once.  The 
ro  hit  situation  is  not  of  interest  here.  The  location  cn 
the  presented  area  of  the  aircraft  of  the  single  hit  ar.d  of 
multiple  hits  is  assumed  in  the  vulnerability  assessment  to 
be  a  random  distribution,  with  each  damage  mechanism  having 
the  same  approach  or  attack  direction.  In  ether  words,  the 
assumption  is  usually  made  that  the  enemy  has  no  capability 
to  direct  hits  to  any  one  particular  component,  subsystem, 
cr  part  of  the  aircraft,  and  that  the  damage  mechanisms 
travel  along  parallel  shotlines.  The  single  hit  case  lays 
the  ground  work  for  the  multiple  hit  case.  In  both  cases. 


Since  both  A^  and  F,  /h  are  generally  f ar.ctions  cf  the 
threat  direction  or  aspect,  the  vulnerable  area  will  also 
vary  with  aspect.  In  the  discussion  that  follows,  it  is 
important  to  recall  that: 


P. 


/H 


=  1  - 


K/H 


(2.2) 


where  P  is  the  probability  the  aircraft  or  component 

S/H 

survives  the  hit,  and  P  H  is  the  probability  of  killing 
that  aircraft  or  component. 

The  kill  probability  of  the  ith  component  given  a 
random  hit  on  the  aircraft,  ?k/H  ,  is: 


P  =  P  x  P 

k/tq  rh/Hi  x  Vhi 


(2.3) 


where  Ph/H.  is  the  probability  the  component  is  hit  giver,  a 
hit  on  the  aircraft,  and  Pk/h  is  defined  as  the  probability 
the  component  is  killed  given  a  hit  on  the  component.  From 
Equation  2.2,  it  fellows  that: 


Ps/Hi  =  1  ~  Pk/Hi  (2.4) 

Using  Eguations  2.1  and  2.3,  arc  solving  for  P.,„  gives: 

■  11  i 

?h/H  =  SD  /  Ap  (2.5) 

i  *■  i 

where  AP  is  the  preserted  area  of  the  total  aircraft  in  the 
plane  normal  to  the  threat  direction.  Substituting 
Eguations  2.5  and  2.1  into  Equation  2.3  determines,  for  any 
random  hit  on  the  aircraft,  the  probability  the  ith  compo¬ 
nent  is  killed,  and  is  given  by: 


Pk/H.  “  Av.  /  AP 

1  l 


(2.6) 
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its  critical  components-  The  vulnerable  area  of  the  typical 

ith  component  is  denoted  by  A  ,  and  the  component  kill 

",i 

criterion  used  is  the  probability  of  kill  given  a  hit, 
P,  ,,  .  To  assist  the  reader  ir  keeping  track  of  the  rota- 

tion  used  in  this  presentation,  the  variable  and  subscript 
definitions  are  summarized  in  Table  2. 


TABLE  2 

1 

1 

Vulnerability  Assessment  Variable  Definitions 

Definition  Variable 

Protabilitv  of  killing  the  ith  component 
given  a  hit  on  the  ith  component 

Pk/hi 

Probability  of  killing  the  ith  component 
given  a  hit  on  the  aircraft 

Pk/Hi 

Probability  of  killing  the  aircraft 
given  a  hit  on  the  aircraft 

PK/H 

vulnerable  area  cf  the  ith  component 

■r-4 

> 

•< 

Vulnerable  area  cf  the  aircraft 

AV 

Presented  area  of  the  ith  ccmponent 

Ap.  1 

Presented  area  of  the  aircraft 

Ap1 

Note  that  a  distinction  is  made  between  com] 
and  aircraft  lesignatel  variables  bv  using 
and  upper  case  subscripts,  respectively. 

sonert  ! 

.over 

1 

_  J 

The  vulnerable  area  cf  the  ith  component  is  defined 
as  the  product  of  *he  presented  area  of  the  component  in  the 
plane  normal  to  the  approach  direction  of  the  damage  mecha¬ 
nism  (the  shotline),  A  ,  and  the  probability  of  kill  cf  the 

component  given  a  hit  or.  the  ccoponent,  P  L.  •>,  .  Thus, 

■'  "  i 

A  =  K  x  P,_  (2.1) 

1  1  ‘  "  1 
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ure  2.14  Typical  Aircraft  Encounter 
An  Externally  Detonating  BE  Warhead 
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E.  VOLNERABILITY  TO  EXTERNALLY  DETONATING  WARHEADS 


Vulnerability  of  an  aircraft  to  an  externally  detonating 
high  explosive  warhead  is  usually  analyzed  in  two  steps. 
The  first  step  is  a  determination  of  the  aircraft’s  vulner¬ 
ability  to  the  blast,  and  the  second  step  analyzes  the 
aircraft’s  vulnerability  to  the  fragments  and  penetrators. 
In  addition,  both  analyses  must  consider  the  encounter  scen¬ 
ario  between  the  aircraft  and  the  missile  at  the  time  of 
warhead  detonation.  For  this  reason,  this  section  has  been 
divided  into  the  following  two  subsections:  the  effect  of 
fragments  and  penetrators  striking  an  aircraft,  and  blast. 
Shortly  after  detonation,  the  blast  front  precedes  the  frag¬ 
ments.  Eventually,  the  fragments  pass  through  the  blast 
front  because  the  fragment  velocity  decay  is  less  than  the 
blast  front  velocity  decay.  The  overpressure  caused  by  the 
warhead  detonation  can  cause  serious  damage  to  aircraft 
structure  and  components.  Dsing  the  conditions  of  the 
encounter  scenario,  the  blast  is  analyzed  for  impulse  and 
overpressure  to  determine  iso-damage  contours  for  an 
aircraft  kill.  If  a  detonation  occurs  close  enough  to 
inflict  serious  blast  damage,  the  fragments  most  likely  will 
cause  much  more  damage  than  that  caused  by  the  blast.  In 
the  fragments  and  penetrators  subsection,  the  vulnerability 
to  fragments  and  penetrators  is  computed  for  both  the  single 
hit  case  and  the  multiple  hit  case.  A  typical  encounter  is 
shown  in  Figure  2.14. 

1.  Effect  of  Fragments/ Penetrators  Striking  an  Aircraft 

The  vulnerability  of  an  aircraft  to  a  single 
impacting  penetrator  cr  fragment  is  usually  expressed  as  a 
total  vulnerable  area,  Av ,  or  as  a  probability  of  aircraft 
kill  given  a  random  hit  on  the  aircraft,  P k/h •  The  vulner¬ 
able  area  concept  is  applicable  to  both  the  aircraft  and  to 


77 


(2)  Energy  Density.  In  this  criterion,  a 
component  kill  is  expressed  in  terms  of  a  required  minimum 
component  surface  area  that  nest  be  exposed  to  a  minimum 
threshold  level  of  the  kinetic  energy  density  of  the 
impacting  damage  mechanisms.  Ibis  criterion  is  applicable 
to  clcsely  spaced  multiple  fragment  hits  and  is  used  for  the 
structural  components,  as  well  as  other  large  components, 
such  as  the  fuel  tarks  and  engines.  For  some  components, 
there  may  be  a  miniaum  mass  of  the  damage  mechanism  below 
which  the  criterion  is  not  applied. 

(3)  Blast.  The  damage  criterion  for  blast  is 
generally  the  critical  values  of  pressure  and  impulse  cn  an 
aircraft  surface  necessary  to  cause  the  specific  component 
damage  level  associated  with  the  assumed  kill  level.  For 
example,  a  dynamic  overpressure  of  two  pounds  per  sguare 
inch  ever  the  upper  surface  of  a  horizontal  tail  for  one 
millisecond  may  be  sufficient  tc  cause  crushing  of  the  skin, 
leading  to  a  loss  of  stiffness  and  the  inability  to  support 
the  flight  loads.  Although  this  criterion  is  usually 
applied  to  the  structural  components  and  control  surfaces, 
the  effects  of  the  blast  can  extend  into  the  interior  of  the 
aircraft  and  can  damage  electrical  wiring,  hydraulic  lines, 
fuel  tank  walls,  and  ether  internal  components  located  close 
to  the  aircraft  skin. 

c.  Computation  of  the  Vulnerability  Measures 

The  procedures  used  to  compute  the  vulnerability 
of  an  aircraft  and  its  components  to  an  externally  deto¬ 
nating  high  explosive  warhead  and  non-explosive  penetrators 
or  fragments,  to  an  internally  detonating  high  explosive 
warhead,  and  to  lasers  are  described  in  the  following  three 
sect  ions. 
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limited  gunfire  testing  provides  some  insight  into  the 
effects  cf  projectile  and  fragment  damage  potential,  there 
is  no  universal  methodology  f cr  arriving  at  a  numerical 
value  for  Pk/-h  .  The  larger  components,  such  as  the  fuel 
tanks  and  engines,  are  especially  difficult  to  evaluate  due 
to  the  multitude  of  local  environments,  the  constantly 
changing  operation  conditions,  and  the  many  different 
failure  modes.  Numbers  for  Ek/h  are  eventually  assigned 
tased  upon  a  combination  of  empirical  information,  engi¬ 
neering  judgment,  and  experience. 

The  location  of  the  component  inside  the 
aircraft  will  have  an  influence  on  its  ultimate  numerical 
probability  of  kill  given  a  hit,  but  not  on  its  Pk/h  func¬ 
tion.  Components  located  behind  thick  structures  cr  dense 
equipment  packs  will  receive  a  level  of  protection  due  to 
the  slowdown  of  the  damage  mechanism  as  it  attempts  to  pene¬ 
trate  the  shielding  components.  The  numerical  value  of  the 
Pk/h  for  the  lowered  velocity  of  impact  will  generally  be 
less  than  the  Pk/h  for  the  impact  of  a  penetrator  cr  frag¬ 
ment  that  was  not  slewed  down.  Other  considerations,  such 
as  spall  and  fragment  breakup  caused  by  the  intervening 
components  also  becomes  important. 

The  area  removal  criterion  defines  a 
specific  amount  of  area  that  must  be  removed  from  a  compo¬ 
nent  in  order  to  kill  that  component.  This  criterion  is 
applicable  to  large  penetrators,  such  as  rods,  and  to  the 
closely  spaced  hits  from  many  fragments.  The  total  compo¬ 
nent  damage  from  a  collection  of  closely  spaced  hits  can  be 
greater  than  the  sum  cf  the  individual  damages  from  the  same 
number  of  widely  spaced  hits.  Cften  there  is  a  synergism  of 
damage  due  to  cracking  and  petalling  between  the  individual 
holes,  and  large  areas  of  component  structure  can  be  removed 
or  destroyed.  This  criterion  is  used  mainly  for  structural 
components. 
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Figure  2.13  Engine  Pk/h  Data 


I 


engine  cculJ  Le  s  u!  ai  v  i  do  1  ii.  t  c  tne  aa  jor  sections  illus¬ 
trated  in  Figure  2-11. 

The  determination  of  the  P  fee  each 

k/h 

component  or  part  cf  a  component  is  a  very  difficult  under¬ 
taking.  It  reguires  a  combination  of  critical  component 
analysis  data  and  sound  engineering  judgment.  Although 


Figure  2.12  Typical  Pk/h  Data  for  a  Flight  Control  Fod 


3 


or  penetrator  striking  velocity,  obliquity  angle,  shape  an  1 
mass  cf  the  fragment  cr  penetrator,  to  be  estimated  for  each 
kill  category  and  level  being  assessed.  In  the  case  of 
externally  detonating  warheads,  high  explosive  projectiles, 
and  contact-fuzed  nissiles,  miss  distance  boundaries 

relating  P  to  burst  points  are  established  to  assess 

K/H 

blast  effects  of  these  threats. 

The  major  result  of  this  task  is  the  specifica¬ 
tion  of  numerical  values  for  the  kill  criteria  for  each 
failure  mode  for  each  critical  component  for  each  threat  to 
be  considered.  Three  specific  kill  criteria  are  currently 
in  use  fcr  the  impacting  damage  mechanisms.  They  are  the 
probability  of  component  kill  given  a  hit,  the  area  removal 
criterion,  and  the  energy  density  criterion.  There  is  a 
fourth  criterion  which  applies  to  the  blast  damage 
mecharisns. 

(1 )  The  Probability  of  Kill  Given  a  Pit 
Function.  The  Pk^h  function  defines  the 
probability  of  a  component  kill  when  impacted  by  a  fragment 
cr  penetrator.  This  criterion  can  be  presented  graphically 
as  a  function  of  the  mass  and  velocity  of  the  damage  mecha¬ 
nism,  or  it  can  be  expressed  in  an  analytical  form.  Figure 
2.  12  is  a  sample  of  Ek/,h  data  fcr  a  flight  control  red. 

The  PR^h  criterion  is  normally  used  for 
components  that  can  be  killed  bj  a  single  hit,  such  as  crew 
members,  control  rods,  electronic  equipment,  and  servoactua- 
tors.  These  components  are  sc  Betimes  referred  to  as  single 
fragment  vulnerable  components.  It  can  also  be  used  for 

some  cf  the  larger  components,  such  as  engines  and  fuel 

tanks.  In  this  case,  the  volume  of  the  large  component  is 

usually  divided  intc  several  smaller  volumes,  and  a 

different  numerical  value  cf  Pk/h  is  assigned  to  each 
volume.  For  example,  a  fuel  tank  could  be  divided  into  the 
ullage,  fuel,  and  external  vcid  spaces,  and  a  turbojet 
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within  the  aircraft.  This  high  explosive  detonation 
produces  internal  blast  and  fragmentation  effects.  These 
fragments  usually  are  smaller  and  slower  than  the  larger 
high  explosive  projectiles  but  the  proximity  of  the  detona¬ 
tion  tc  the  critical  components  results  in  a  spray  of  many 
fragments  impacting  the  components.  This  combination  of 
internal  blast  and  fragmentation  effects  is  especially 
lethal  to  lightly  constructed  components  such  as  oil  and 
fuel  lines,  oil  and  fuel  tanks,  hydraulic  tanks,  and  the 
aircrew. 


b.  Critical  Component  Fill  Criteria 

Once  the  set  of  critical  components  for  a  given 
aircraft  has  been  identified,  the  damage  or  kill  criteria 
for  each  of  the  failure  modes  of  these  components  must  be 
determined  for  the  selected  threats.  Damage  criteria  for  a 
critical  component  is  the  level  of  damage  required  for  a 
preestablished  degradation  of  the  performance  of  the  compo¬ 
nent.  Thus,  a  kill  criterion  is  the  specific  descriptive 
characteristics  or  guantif ication  of  a  component  failure. 
Some  examples  of  critical  competent  kill  criteria  are:  the 
amount  cf  material  that  must  be  removed  from  a  drive  shaft 
for  failure,  requirements  for  failure  of  a  structural 
member,  the  amount  cf  damage  required  to  incapacitate  a 
system  of  gears,  the  minimum  diameter  of  hole  in  a  fuel  tank 
or  line  for  engine  starvaticr  within  a  specified  time 
period,  etc.  Very  few  kill  criteria  are  precisely  known, 
nor  can  they  easily  be  determired.  Battle  damage  reports 
are  an  important  source  of  component  damage  effects  informa¬ 
tion.  The  results  of  tests  conducted  on  all  types  of 
aircraft  components  ard  subsystems  provide  another  increas¬ 
ingly  important  and  expanding  source  of  data.  Data  is 
required  for  each  critical  ccsponent  that  allows  for  the 
effects  cf  encounter  parameter  variations,  such  as  fragment 
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a. 


Threat  Selection 


Because  cf  the  many  diverse  and  terminal  effects 
of  the  various  damage  mechanisms,  each  vulnerability  assess¬ 
ment  is  usually  made  considering  either  a  specific  threat  or 
a  specific  damage  mechanism.  Mechanisms  which  may  cause 
damage  tc  an  aircraft  may  be  classified  as:  kinetic  energy 
penetratcrs  such  as  projectiles  and  fragments,  internal  and 
external  blast,  pyrcphorics,  shaped  charged  jets,  focused 
blast  fragments  and  lasers. 

Kinetic  energy  penetrators  include,  tut  are  not 
limited  to,  ball  projectiles,  armor  piercing  projectiles, 
and  fragments.  These  penetratcrs  cause  damage  to  aircraft 
components  during  penetration  and  perforation.  Armor 
piercing  projectiles  are  constructed  with  a  hardened  core 
which  enhances  the  penetration  characteristics  of  these 
projectiles  over  those  of  the  lall  type.  Most  small  armor 
piercing  projectiles  are  prone  to  tumbling  after  impact 
thereby  increasing  the  size  of  the  hole  that  they  tear  in 
the  internal  components. 

Armor  piercing  incendiary  projectiles  contain  an 
incendiary  nix  encased  within  the  nose  of  the  projectile 
ahead  of  a  hardened  case.  Upon  impact  the  jacket  peels  off, 
and  the  incendiary  material  flashes  as  the  projectile  core 
penetrates  the  target. 

Large  high  explosive  projectiles  and  missiles 
can  be  equipped  with  influence  cr  command  fuzes  causing  them 
to  detonate  nearby  an  aircraft.  These  projectiles  or 
missiles  have  the  capability  of  inflicting  damage  from 
external  blast  effects,  fragment  impact  effects,  or  a  combi¬ 
nation  cf  both. 

Many  smaller  high  explosive  projectiles  are 
equipped  with  delay  fuzes.  These  fuzes  initiate  upon 
contact  with  the  aircraft  skin  and  detonate  the  projectile 
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F.,,  .  Another  measure  of  vulnerability  to  impacting  damage 
mechanisms  is  the  aircraft's  vulnerable  area,  A 
Vulnerable  area  is  a  theoretical,  non-unique  area  presented 
to  the  threat  which,  if  hit  by  a  damage  mechanism,  would 
result  in  an  aircraft  kill.  Cr  the  other  hand,  when  damage 

is  caused  by  the  effects  of  a  rearby  high  explosive  detona¬ 
tion,  the  vulnerability  may  be  expressed  in  the  form  of  a 
(probability  of  kill  given  a  detonation)  envelope. 
This  envelope  represents  a  kill  probability  contour  about 
the  aircraft  on  which  a  specified  detonation  will  result  in 
a  certain  probability  of  aircraft  kill.  If  only  the  blast 
from  the  exploding  warhead  is  considered,  the  env!  cpe 
represents  the  aircraft's  vulnerability  to  external  b  ast. 
A  measurement  which  is  becoming  more  important  relates  to 
aircraft  vulnerability  to  a  laser  threat.  Laser  vulner¬ 
ability  can  be  measured  by  the  probability  of  kill,  given  a 
specific  power  laser  lock-on  for  a  specified  period  of  time, 
r 

K/Lo  * 

3  -  General  Requirement  s 

Certain  required  elements  of  a  vulnerability  assess¬ 
ment  are  common  to  all  studies,  regardless  of  the  type  of 
threat  considered.  These  elements  are:  (1)  a  selection  of 

the  aircraft  kill  levels  or  categories  to  be  assessed,  (2) 
an  assembly  of  the  technical  a rd  functional  descriptions  of 
the  aircraft,  (3)  a  determination  of  the  critical  components 
of  the  aircraft,  (4)  a  selecticr  of  the  specific  threats  the 
system  will  encounter,  (5)  an  analysis  to  identify  the  type 
and  amount  of  damage  required  to  kill  each  critical  compo¬ 
nent,  and  (6)  the  computation  of  the  appropriate  vulner¬ 
ability  measures  for  the  components  and  the  aircraft  based 
upon  the  threat  selected.  The  first  three  steps  of  the 
assessment  have  been  described  in  the  preceding  section.  A 
presentation  of  the  last  three  steps  follows. 
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the  influer.ee  of  nonredundancy  and  redundancy  of  ccufcr.er.ts 
on  the  vulnerable  area  oust  be  examined.  Overlap  cf  crit¬ 
ical  components  is  also  an  important  consideration. 

a.  Single  Hit  Vulnerability 

Both  the  nonredundant  aircraft  model  and  the 
redundant  aircraft  model  considered  in  this  section  are 
assumed  to  receive  orly  one  hit.  The  nonredundant  aircraft 
model  is  composed  of  only  one  cf  each  of  the  critical  compo¬ 
nents.  Thus,  the  less  of  any  one  critical  component  will 
cause  the  loss  of  the  aircraft.  In  the  redundant  aircraft 
model,  seme  of  the  critical  component  functions  are  dupli¬ 
cated  by  the  same  or  different  components.  The  effects  of 
overlapping  of  both  nonredundant  and  redundant  critical 
components  are  examined.  For  example,  the  fact  that  an 
engine  overlaps  (shields)  a  hydraulic  pump  will  probably 
decrease  the  probability  of  kill  of  that  pump.  It  is  neces¬ 
sary  to  specify  how  this  overlap  effect  is  quantified  for 
both  the  nonredundant  and  redundant  aircraft  models. 

(1)  Aircraft  Model  Composed  of  B2£.E§<3u  ndant 
Components  with  No  Overlap.  This  aircraft 
consists  of  N  critical  components  whose  functions  are  not 
duplicated  by  any  ether  component.  The  components  are 
arranged  in  such  a  way  that  nc  components  overlap  when 
viewed  from  a  given  aspect.  Ary  hit  on  the  aircraft  takes 
place  along  a  shotlire  that  passes  completely  through  the 
aircraft.  Thus,  nc  more  than  one  component  can  be  hit  on 
any  one  shotline.  As  an  exanple.  Figure  2.15  shows  an 
aircraft  consisting  of  three  critical  components:  a  pilot, 
one  fuel  tank,  and  one  engine.  None  of  the  critical  compo¬ 
nents  overlap  in  the  aspect  presented  in  Figure  2.15. 

The  probability  of  killing  this  aircraft, 
given  a  random  hit  on  the  presented  area  in  Figure  2.15,  can 
be  derived  using  the  kill  expression  and  Equations  2.1  and 
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Non iedundan t  Aircraft  Hodel  Kith  No  Overlap 


r 

i 


2.6.  For  an  aircraft  composer  of  N  nonredundant  critical 
components,  the  kill  expression  is: 

Kill  =  (Nrcl)  .OR.  (Nrc2)  .OR.  ...  (NrcN)  (2.7) 

where  Nrci  refers  to  a  kill  of  the  ith  nonredundant  ccmpo- 
nent.  In  other  words  the  aircraft  kill  is  defined  by  the 
kill  of  nonredundant  component  number  1,  or  nonredundant 
component  number  2,  or  ...»  or  nonredundant  component  number 
N.  Because  a  kill  of  any  one  of  the  critical  components 
will  kill  the  aircraft,  the  aircraft  will  survive  only  if 
all  of  the  nonredundant  critical  components  survive.  Thus, 

P  =  P  xP  x...xE  (2.8) 

S/H  s/H1  s/H2  s/Hn 

Using  Eguation  2.4,  Equation  2.£  may  be  written  as: 


S/H 


(1  '  P*/Hi> 
P 


X  (1  - 


X  (1  - 


k/«N  ) 


P  k/H25 


(2.9) 


For  our  model  aircraft  N=3,  and  Eguation  2.9  becomes: 


PS/H  =  1  “  {Pk/H1  +  Pk/»2  +  VH3  5  + 

(Pk/H-L  X  Pk/H2)  *  ^k/H!  X  Pk/H3  )  +  ^Pk/H2  X 

pk/H3  )  “  (Pk/Hj^  x  E  k/H2  x  Pk/H 3  ) 


Because  of  the  assumption  that  cnly  the  component  hit  can  be 
killed,  and  because  ncne  of  the  critical  components  overlap, 
the  kills  of  the  components  are  mutually  exclusive.  This 
means  only  one  component  can  be  killed  by  one  hit,  and  the 
products  of  the  Pk/H.  given  in  Eguation  2.10  are  not  appli¬ 
cable.  Therefore,  Eguation  2. 1C  simplifies  to: 


S/H 


=  1  "  (P. 


k/H, 


♦  P 


k/H- 


/H, 


(2.  11) 
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and  the  probability  cf  killing  the  aircraft  given 
the  aircraft  is  just  the  sun  of  the  individual  pro 
of  killing  each  of  the  critical  components  given 

hit  or  the  aircraft.  This  may  he  written  as: 

a  hit  on 

ba  hi lities 

a  random 

PK/H  =  Pk/Hi  +  Pk/H2  +  +  Ek/HN 

(2.  12) 

Substituting  Eguation  2.6  into  Equation  2.8,  and  applying 

the  concept  of  P,</h  expressed  it  Equation  2.1,  leads  to: 

p  K/H  Av  ^  Ap 

(2. 13) 

where  A  is  the  summation  of  vulnerable  area  of  all  cf  the 

V 

critical  components. 

For  our  example  aircraft,  the  kill  expres¬ 
sion  is  given  by: 

Kill  =  (Pilot)  .OR.  (Fuel  Tank)  .OR.  (Engine) 

(2. 14) 

From  Eguation  2. 12: 

?  =  P  +  p  +  P 

K/H  k/Hp  k/Hf  rk/He 

(2.  15) 

and 

Av  =  K  +  K  +  Av 

p  f  e 

(2. 16) 

where  the  subscripts  p,  f,  and  e  denote  the  pilot, 

tank,  and  the  engine.  From  fguation  2.  1,  the 

component  areas  are  given  by: 

the  f  ue  1 

i  ndi v id ua  1 

A,_  =  A  x  P. 

v  p  k/h 

P  P  P 

(2.  17) 

A  =  A  x  P 

(2.  18) 

pf  k/hf 
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For  illustration,  a  numerical  example  is 
presented  in  Table  3. 


TABLE  3 

Nonredundant  Hodel  Without  Overlap 
With  Mutually  Exclusive  Kill  Modes 


Critical 

Component 

X  Pk/h. 

A 

v . 

1 

P  k/H 

i 

Pilot 

4  ft* 

1.0 

4 

ft* 

.0  133 

Fuel 

60  ft* 

0.3 

18 

ft* 

.  0600 

Engine 

50  ft* 

0.  6 

30 

ft* 

.  1000 

A  =  300 

p 

ft* 

A  =  52  ft* 

V 

p 

K/H 

=  .  1733 

The  kill  of  ere  critical  component  due  to 
damage  caused  by  a  hit  on  another  critical  component  and  the 
consideration  of  multiple  kill  nodes  of  a  critical  component 
can  be  indirectly  accounted  for,  in  this  model,  by 
increasing  the  numerical  value  cf  the  kill  criterion  for  the 
component  hit.  Consider  two  failure  modes  that  are  not 
mutually  exclusive,  that  is,  both  can  occur  with  a  single 
hit.  For  example,  suppose  the  probability  the  fuel  tank  of 
an  aircraft  is  destroyed  by  a  fire  when  the  fuel  tank  is 
hit,  is  taken  as  0.3.  Suppose  further  that  the  probability 
that  the  fuel  tank  is  penetrated  and  that  hydraulic  ram 
damage  causes  fuel  to  be  dumped  into  the  air  inlet  and 
ingested  by  the  engine,  leadirg  to  an  aircraft  loss,  is 
taken  as  0.1.  The  aircraft  will  survive  a  hit  in  the  fuel 


tank  cnly  if  there  is  neither  a  fire  nor  any  fuel  ingestion. 
The  probability  that  neither  of  these  failure  modes  occur 
when  the  fuel  tank  is  hit  is  civen  by  the  product  of  the 
probability  that  there  is  no  fire  (1  -  0.3),  and  the  prob¬ 
ability  that  there  is  no  fuel  ingestion  kill  of  the  engine 
(1  -  0.1),  which  is  0.63.  Therefore,  the  probability  that 
there  will  be  a  fire  kill  anc/or  a  fuel  ingestion  kill, 
given  a  hit  on  the  fuel  tank,  is  given  by  (1  -  0.63)  ,  or 
C.37.  A  numerical  example  is  presented  in  Table  4. 


TABLE  4 

Honredundant  Model  Without  Overlap 
With  Mutually  Inclrsive  Kill  Modes 


Critical  A  x  P  „  =  A  P 


Component 

Pi 

k/hi 

vi 

k/Hi 

Pilot 

4 

ft* 

1.0 

4.0  ft* 

.0133 

Fuel 

60 

ft* 

0.  3  7 

22.2  ft* 

.0740 

Engine 

50 

ft* 

0.  6 

30.0  ft* 

.1000 

A  p  =  300  ft*  A y  =  56.2  ft*  P  K/H  =  .1873 


Note  that  in  this  case  the  P  ,  is  net 

k/h 

the  sum  of  the  two  individual  kill  probabilities  because 
there  can  be  both  a  fire  kill  and  a  fuel  ingestion  kill  on 
the  one  hit.  Comparing  Table  3  with  Table  4  shows  that  by 
accounting  for  the  additional  failure  mode  of  fuel  irgestion 
by  the  engine  increases  the  fuel  tank  Pk/h  with  the  accompa¬ 
nying  change  in  component  and  aircraft  vulnerable  area,  and 
the  component  and  aircraft  probability  of  kill.  This  same 
procedure  can  be  used  to  compute  the  ? k/h .  due  to  multiple 
failure  modes  of  one  critical  component. 
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(2)  Aircraft  Model  Composed  of  Non  redundant 
Com  tcnen ts  with  Overlap.  The  aircraft 
model  will  now  be  expanded  by  allowing  two  or  more  critical 
components  to  overlap  in  an  arbitrary  manner.  An  example 
aircraft  is  presented  in  Figure  2.16.  There  can  be  any 
number  of  critical  components  along  a  shotline  within  the 
overlap  area.  For  the  aircraft  to  survive  a  hit  alcng  a 
shotline  within  a  region  of  N  overlapping  critical  compo¬ 
nents,  each  critical  component  along  that  shotline  must 
survive.  The  probability  the  aircraft  survives  a  hit  on  the 

overlap  region,  P  ,  ,  is  given  by: 

s/no 


Ps/hQ  P s/hL  x  Ps/h2  x  **•  x  Ps/hN  (2.c0) 

Because  two  or  more  critical  components  in  the  overlap 
region  can  be  killed  by  one  hit,  the  kills  of  more  than  one 
component  are  not  mutually  exclusive.  In  this  case, 
Equation  2.11  is  not  valid,  and  Equation  2.20  must  be  used 
for  hits  in  the  overlap  region.  For  the  aircraft  illus¬ 
trated  in  Figure  2.16,  the  probability  the  aircraft  survives 
a  hit  on  the  overlap  region  is  given  by  Equation  2.21,  where 
the  subscripts  f  and  e  refer  to  the  fuel  tank  and  the 
engine . 


P  =  P  x  P 

s/hQ  s/hf  *  rs/he 


(2.21) 


If  the  overlap  area,  A  ,  is  new  consid- 

Po 

ered  as  a  separate  component,  the  probability  of  kill  given 
a  hit  on  the  component  may  be  written  as: 


k/h 


=  1  -  P 


s/h 


(2.22) 
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Figure  2.16  Norredundant  Aircraft  Model  With  Overlap 


and  the  vulnerable  area  of  the  overlap  area,  A,7  ,  is  given 

ty: 

A  =  A  X  P 

vo  Po  k/ho 

Substituting  Equation 
Equation  2.4,  gives: 

Pk/h  =  1  -  t(1  -  ek/h  )  X  (1  -  P  )]  (2.24) 

o  f  '  e 

It  is  assumed  for  this  example  that  the 
overlap  area  in  Figure  2.16  is  10  ft2,  the  fuel  tank  Fk/h  is 
0.3,  the  engine  P,  is  0.6,  and  all  other  areas  are  the 
same  as  used  in  the  nonoverla pping  example.  The  fuel  is 
assumed  tc  slow  the  damage  mechanism  down,  but  not  enough  to 
change  the  engine  Pk/h  .  Becacse  the  P^/h  values  are  the 
same  as  in  the  nonoverlapping  example,  any  reduction  in  the 
vulnerable  area  of  the  aircraft  is  due  only  to  the  component 
overlap.  Thus,  in  the  overlap  region: 

pk/h0  =  1  "  [(1-0.3)  x  (1-0.6)  ]  =  0.72  (2.  25) 

and 

A  =  10  x  0.72  =  7.2  ft2  (2.26) 

vo 

according  to  Equations  2.23  and  2.24. 

The  vulnerable  area  of  the  overlap  area 
contributes  to  the  aircraft  vulrerable  area.  However,  over¬ 
lapping  also  requires  that  the  overlap  area  be  subtracted 
from  the  total  presented  area  cf  each  overlapping  component 
contributing  to  the  overlap.  dhe  component  area  outside  of 
the  overlap  is  treated  in  the  usual  way.  Table  5  illus¬ 
trates  computing  the  vulnerable  area  of  an  aircraft  with 


(2.23) 

2.21  intc  Equation  2.23,  and  using 
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overlapping  components.  Note  that  locating  two  of  the  crit¬ 
ical  components  such  that  one  overlaps  the  other  reduces  the 
aircraft  vulnerable  area  form  52  ft2  to  50.2  ft2.  This  is 
an  example  of  how  location  of  the  critical  components  can 
reduce  the  aircraft's  vulnerable  area. 


TABU  5 

Vulnerable  Area  Computation  for  Nonredundant 
Model  With  Overlap  aid  No  Engine  ”4re 


Critical 

Component 

X 

P  k/h  . 

=  A 

V  . 

1 

Pilot 

4 

ft2 

1.0 

4.0 

ft2 

Fuel 

60-10=50 

ft2 

0.3 

15.0 

ft2 

Engine 

50-1 0=40 

ft2 

0.6 

24.0 

ft2 

Overlap 

Area 

10 

ft2 

0.72 

7.2 

ft2 

Av  =  50.2 

ft2 

The  net  effect  of  component  overlap  can  be 
a  desirable  reduction  in  aircraft  vulnerable  area  provided 
the  damage  inflicted  by  the  hit  in  the  overlap  area  does  not 
cause  ether  problems.  For  example,  consider  a  shctline 
through  the  fuel  tank  that  overlaps  the  engine.  Fuel  could 
leak  from  the  punctured  tank  onto  hot  engine  parts,  causing 
a  fire.  In  this  instance,  the  probability  the  engine  is 
killed  by  the  hit  wculd  probably  be  higher  than  0.6.  An 
example  of  the  computation  cf  aircraft  vulnerable  area, 
assuming  the  possibility  of  an  engine  fire,  is  given  in 
Table  6.  The  overlapping  area  is  assumed  to  be  10  ft2,  the 

fuel  tank  P,  is  assumed  to  be  0.3,  and  the  P.  for  the 

k/h  '  k/h 


engine  is  taken  as  0.5  because  an  engine  fire  is  assumed  to 
occur  nearly  always  due  to  a  hit  on  the  overlapping  fuel 
tank.  Then, 

P  =  1  -  [  {1  -  0.3)  x  (1  -  0.9)  ]  (2.27) 

k/h 

o 

and  the  aircraft’s  vulnerable  area  increases  to  52.3  ft2. 


TABLE  6 

Vulnerable  Area  Computation  for  Honredundant 
Model  With  Overlap  ard  an  Engine  Fire 


ritical 

cmpcnent 

A 

pi 

2 

Pk/hi 

=  A 

v . 
i 

filet 

u 

ft2 

1.0 

4.0  ft  2 

Fuel 

60-10=50 

ft2 

0.3 

15.0  ft2 

Engine 

5  0-1040 

ft2 

0.6 

24.0  ft2 

Cverlap 

Area 

10 

ft2 

0.93 

9.3  ft2 

A  =  52.3  ft2 

Comparing  the  aircraft's  vulnerable  areas 
given  in  Tables  3,  5,  and  6  reveals  that  overlapping  the 
engine  with  the  fuel  tank  reduces  the  vulnerable  area  from 
52  ft2  to  50.2  ft2,  provided  nc  fire  can  occur.  If  a  fire 
is  likely  to  occur,  the  vulnerable  area  increases  fcrm  52 
ft2  tc  52.3  ft2.  Thus,  overlapping  nonredundant  critical 
components  can  reduce  vulnerability  provided  that  no  undesi¬ 
rable  secondary  kill  modes  occur. 

Another  facet  of  the  overlap  situation  is 
the  change  in  the  vulnerable  area  of  the  overlap  area  that 
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occurs  when  one  of  the  components  along  a  shotline  has  its 
vulnerability  reduced  by  use  cf  a  vulnerability  reduction 
technique.  For  example  suppose  the  ?,</v,  of  the  overlapping 
fuel  tank  is  reduced  from  0.3  to  0.0.  The  vulnerable  area 
of  the  overlap  section,  with  the  possibility  of  a  fire,  is 
reduced  from  7.2  ft2  to  6.0  ft2.  This  reduction  appears  to 
conflict  with  the  fact  that  10  ft2  with  a  Pk/h  of  0.3,  and  a 
vulnerable  area  of  3.G  ft2,  has  been  made  invulnerable.  The 
reason  fcr  this  apparent  contr a  diction  is  the  fact  that  the 
fuel  tark  is  only  one  of  two  overlapping  components. 
Generally,  when  the  vulnerability  of  one  component  is 
reduced,  the  vulnerability  of  another  component  along  the 
shotline  will  become  lore  important.  The  vulnerable  area  of 
each  component  along  the  shotline  is  referred  to  as  the  true 
vulnerable  area,  and  the  components  contribution  to  the 
overlap  vulnerable  area  is  referred  to  as  the  incremental 
vulnerable  area.  Using  the  data  of  Table  5,  the  true  vuln¬ 
erable  areas  are  3  ft2  and  6  ft2  for  the  overlapping  fuel 
tank  and  engine  areas,  and  the  incremental  vulnerable  areas 
of  the  two  overlapping  componerts  are  1.2  ft2  and  4.2  ft2 
respectively. 

(3)  Aircraft  Mo^el  Composed  of  Redundant 
Components  with  No  Overlap.  The  non  redun¬ 
dant  aircraft  model  described  above  will  now  be  expanded  by 
adding  a  second,  separated  engine,  as  shown  in  Figure  2.17. 
The  second  engine  is  assumed  to  have  the  same  presented  area 
as  the  first  engine,  50  ft2,  but  its  Pk/h  is  taken  as  C.7 
because  cf  the  presence  of  an  additional  accessory  drive. 
For  the  purpose  cf  comparison,  the  aircraft’s  presented  area 
will  remain  300  ft2.  The  kill  expression  for  this  model 
aircraft  is: 


Kill  =  (Pilot)  .OR.  (Fuel  Tank)  .OR. 
[  (fngine  1)  .AND.  (Fngine  2)  ] 


(2.28) 


Figure  2.17  Redundant  Aircraft  Hodel  With  No  Overlap 


Table  7  presents  the  values  fcr  the  vulnerability  caraie- 
ters.  The  Equation  fcr  the  prclabilitv  of  aircraft  survival 
giver  a  random  hit  on  the  aircraft  is: 


P 


S/H 


x  P  s/h  f  x  n 


'£k/h  .  x  Vh  ,  >  1  <2-29) 

/  ei  e2 


which  can  he  rewritten  as: 


P  S/H 

[  1 


(1  ~ 

*Pk/H 


Pi 


k/Hp  ) 


X  P 


e  1 


k/H 


e2 


(1  ' 

)  ] 


Pk/Hf  ) 


(2.20) 


TABLE  7 

Redundant  Aircraft  Eocel  Without  Overlap 


Critical 

Component 

A 

pi 

X  ?k/h 

'  i 

A  v. 

1 

P> 

Filet 

4 

ft? 

1 .  c 

4 

ft* 

.  0  132 

Fuel 

60 

ft* 

0.2 

18 

ft* 

.  0600 

Engine  1 

50 

ft* 

0.6 

30 

ft* 

.1000 

Engine  2 

50 

ft* 

0.7 

35 

ft* 

.1167 

A  ^  = 

300  ft* 

\7  =  22  ft* 

P  K/H 

=  .0733 

Equation  2.30  says  th?5  the  aircraft  is  killed  if  the  pilot 
is  killed,  or  if  the  fuel  tank  is  killed,  or  if  both  engines 
are  killed.  Carrying  out  the  multiplication  indicated  in 
Equation  2.30  reads  tc: 


=  1 


x 

X 


(? 

p, 


H^. 


) 


+  **/!!«  ) 
+  ^/H 


•f 


♦  ? 


/  h 


X  ft  :!,) 

- 


X 


(2.  21) 
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If  the  assumption  is  made  that  the  single  hit  cannot  kill 
loth  engines  (recall  the  assumption  that  only  the  component 
hit  can  he  killed) ,  then  all  of  the  component  kills  are 
mutually  exclusive,  and  all  of  the  products  of  the  component 
kill  p  ictahilities  in  Equation  2-31  are  zero.  Hence,  the 
aircraft  is  killed  only  if  the  pilot  or  the  fuel  tank  is 
killed,  and  the  PK/H  and  Ay  are: 


K/H 


=  P 


k/H_ 


+  p. 


k/Hf 


(2.32) 


A  =  A  ♦  A  (2.33) 

V  v  v, 

P  f 

In  general,  only  these  componeits  whose  loss  or  damage  can 
cause  a  kill  of  the  aircraft  on  a  single  hit  will  contribute 
their  vulnerable  area  to  the  total.  If  the  single  hit  kills 
only  one  of  the  redundant  components,  the  aircraft  is  not 
killed,  and  hence,  nothing  is  contributed  to  the  vulnerable 
area.  Thus,  the  total  vulnerable  areas  for  this  case  is 
just  the  sum  of  vulnerable  areas  for  each  of  the  nonredun- 
dant  critical  components.  Comparing  Table  7  with  Table  3 
shows  the  single  hit  vulnerable  area  reduces  from  52  ft2  to 
22  ft2  due  to  the  addition  of  the  second  engine.  Thus, 
redundancy  can  significantly  reduce  the  vulnerable  area  of 
the  aircraft.  On  the  other  hand,  if  the  damage  to  the 
redundant  component  which  is  hit  creates  secondary  damage 
mechanisms  or  processes  that  propagate  to  another  redundant 
component  and  kills  that  component,  causing  a  loss  of  the 
aircraft,  the  redundant  comporents  will  contribute  to  the 
aircraft  vulnerable  areas.  For  example,  suppose  the  prob¬ 
ability  that  a  hit  on  one  of  the  engines  will  cause  that 
engine  tc  throw  blades  into,  cr  torch,  or  burn  the  other 
engine  is  0.1.  Because  this  can  happen  regardless  of  the 
engine  hit,  the  component  presented  area  becomes  50  ♦  50,  cr 
100  ft2,  and  the  vulnerable  area  contributed  by  both  engines 
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is  10  ft2.  Thus,  this  failure  mode  increases  the  aircraft 
vulnerable  area  to  32  ft2. 

(4)  Aircraft  Model  Composed  of  Redundant 
Components  Hi  th  Overlap .  If  redundant 

components  are  nov  allowed  to  overlap  one  another,  as  shown 
by  the  aircraft  in  Figure  2.18,  the  computation  of  the  vuln¬ 
erable  area  given  by  Eguation  2.29  must  be  modified  because 
a  single  hit  in  the  overlap  region  can  kill  both  engines. 

For  this  case,  the  cross  hatched  area 
shown  in  Figure  2.18  is  defined  as  the  overlap  area.  A 
single  hit  penetrating  this  area  will  have  a  probability  of 
killing  both  redundant  components,  and  hence  the  aircraft. 
Thus,  it  will  be  necessary  to  add  the  vulnerable  area  of  the 
overlap  region  to  that  of  the  ronredundant  critical  compo¬ 
nents.  In  essence,  the  overlap  region  becomes  another  crit¬ 
ical  component,  as  in  the  nonredundant  model  with  overlap. 
The  vulnerable  area  is  computed  in  the  same  manner  as 
described  previously;  however,  the  details  are  slightly 
different.  The  expression  for  Pg/,h  given  by  Eguation  2.20 
must  be  modified.  According  to  Eguation  2.20,  the  prob¬ 
ability  that  the  aircraft  survives  a  hit  on  an  overlap  area 
with  no  redundant  components  is  given  by: 


x  P= 


(2.34) 


However,  if  there  are  two  redundant  components  amcng  the 
components  along  the  shotline,  such  as  components  number  2 
and  number  3,  the  prcbability  that  both  are  killed,  which  is 
assumed  to  cause  an  aircraft  kill,  is  equal  to  the  product 
of  their  individual  probabilities  of  kill,  (P  k/h2  x  Pk/h3  )  • 
The  probability  that  both  components  are  not  killed,  which 
is  reguired  for  aircraft  survival,  is  the  complement  of 

<pk/h2  *  Vh  >'  or  n-iVh2  x  pk/h  )]•  ^us,  (pS2  x  pS3) 
in  Eguation  2134  must  be  replaced  with  [1-  (Pk/1l2  *  P)C/h3 )  ] 

and  the  result  is  given  by  Eguation  2.35. 
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V  - 


P  =  F  x  [  1  -  (P  x  P  )]  x  ...  x  P  (2.35) 

s/hQ  s1  k/h2  k/h3  sN 

For  our  example,  the  probability  the  aircraft  will  survive  a 
hit  on  the  overlap  region  is  given  by: 


s/h 


«  1  -  (P 


s/hel 


X  P  ) 

s/he2 


(2.36) 


and  the  probability  of  kill  given  a  hit  on  the  overlap 
region  is: 


'  k/h 


=  i  -  C 1- IP. 


k/h 


x  P 


el 


k/h 


)  ] 


e2 


(2.37) 


This  procedure  can  be  extended  to  the  situation  where  there 
are  three  or  more  redundant  overlapping  components  or 
multiple  sets  of  overlapping  redundant  components. 

The  "elsewhere”  or  non-overlapping  areas 
of  each  of  the  redundant  compcnents  are  not  used  in  the 
vulnerable  area  computations  fcr  the  same  reason  as  that 
used  in  the  no  overlap  case.  I  single  shotline  through  any 
one  cf  the  redundant  componerts  outside  of  the  overlap 
region  causes  only  a  kill  of  that  component,  net  of  the 
aircraft,  and  hence  no  contribution  is  made  to  the  aircraft 

vulnerable  area.  If  the  P,  ^  values  for  the  engines  in  the 

k/h 

overlap  region  shown  in  Figure  2.18  are  taken  as  0.6  for  the 
first  engine  hit  and  0.2  for  the  overlapped  engine  (the 
overlapping  engine  slows  the  carnage  mechanism  down) ,  the 
probability  the  aircraft  will  survive  a  hit  on  the  overlap 
region  is  given  by  Eguation  2.36  and  is  equal  to  0.88.  The 
probability  of  an  aircraft  kill  given  a  hit  in  the  overlap 
region  is  given  by  Eguation  2.31  and  is  equal  to  0.12.  If 
the  overlap  area  is  assumed  to  be  10  ft2,  the  vulnerable 
area  increases  to  23.2  ft2  due  to  the  overlapping  engines  as 
shown  by  the  computation  in  Table  8. 


99 


TABU  8 

Redundant  Aircraft  Hcdel  With  Overlap 


Critical 

Component 

A 

Pi 

X  Pk/hi 

=  V 

1 

Pk/Hi 

Pilot 

4  ft* 

1.0 

4.0 

ft* 

.0133 

fuel 

60  ft* 

0.3 

18.  0 

ft* 

.0600 

Overlap 

Area 

10  ft* 

0.12 

1.2 

ft* 

.00  40 

A  = 

300  ft* 

A  =  23. 

2  ft* 

P 

=  .0773 

b.  Multiple  Eit  Vulnerability 

The  analysis  will  now  progress  to  the  more 
reasonable  expectation  that  in  any  combat  engagement,  an 
aircraft,  if  hit,  will  receive  more  than  one  hit.  The 
distribution  of  these  hits  over  the  aircraft  is  assumed  to 
be  random,  and  all  hits  are  assumed  to  travel  along  shot¬ 
lines  from  the  same  direction.  This  latter  assumption  is 
not  required,  but  is  taken  for  case  of  explanation. 

The  probability  the  ith  component  still  survives 
after  n  random  hits  cn  the  aircraft,  denoted  by  p/./h-  •  is 
equal  tc  the  product  of  the  component  survival  probabilities 
for  each  of  the  n  hits  on  the  aircraft.  The  superbar  nota¬ 
tion  cn  P  indicates  the  joint  probability,  and  the  super¬ 
script  c  in  parentheses  indicates  the  hit  number.  Thus, 

V”1  ■  1  t(.%t  1  <2-3a> 

i 

where  Ps/ni  is  the  probability  the  ith  component  survives 
the  jth  hit  on  the  aircraft.  The  probability  of  survival  of 
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the  ith  component  due  to  the  jth  hit  on  the  aircraft  is 
egual  to  one  minus  the  probability  of  kill  of  the  ith  compo¬ 
nent  due  to  the  jth  hit  on  the  aircraft.  Thus, 


(j 

S/H 


(2.39) 


Recall  that  P.  is  assumed  to  be  a  constant  value  for  all 

K/Hi 

j.  Thus,  Eguation  2.38  can  be  civen  in  the  form: 

p s/h  =.  I  n  -  Kjl,  )  -  i  1  -  pk/Hi  3n  <2*40> 

The  probability  of  survival  of  the  aircraft 
after  n  hits  can  be  derived  in  a  similar  manner  to  gi7e: 


:(j) 

rK/H 


(2.41) 


where  is  the  probability  of  kill  of  the  aircraft  due  to 
the  jth  hit  on  the  aircraft,  and  may  or  may  not  be  constant 
for  all  j.  The  probability  the  aircraft  is  killed  after  n 
hits,  Pj^j  ,  is  the  ccaplement  cf  P^  ,  or: 


(n) 

PK/H 


P(n) 

S/H 


=  1  - 


n 

n 

j=i 


i’  -  > 


(2.42) 


In  any  multiple  hit  assessment,  it  is  necessary 
to  keep  in  mind  the  distinction  between  the  effect  of 
multiple  hits  on  tie  vulnerable  area  of  a  nonredundant 
aircraft  model  as  opposed  to  bits  on  a  redundant  aircraft 
model.  Multiple  hits  on  a  ncrredundant  aircraft  model  do 
not  change  the  total  vulnerable  area  and  the  PR/H  because  of 
the  assumption  that  components  are  either  fully  functional 
or  killed.  If  a  shot  hits  the  aircraft,  but  not  a  critical 
component,  the  vulnerable  area  and  the  PK/H  remain  the  same. 
Cnly  when  a  hit  actually  strikes  the  vulnerable  area  of  a 
nonredundant  critical  component  is  the  aircraft  killed. 
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The  redundant  aircraft  model  has  to  be  viewed 
differently.  If  the  redundant  aircraft  takes  the  first  hit 
in  the  vulnerable  area  of  a  redundant  component,  the 
aircraft  is  not  killed,  but  the  aircraft  vulnerable  area  and 
the  P  will  increase  for  the  second  hit  because  cne  cf  the 

K/H 

redundant  components  has  been  killed.  For  instance,  if  one 
of  twc  engines  is  killed  on  the  first  hit,  the  aircraft 
vulnerable  area  is  new  increased  by  the  vulnerable  area  of 
the  remaining  engine  because  a  kill  of  the  remaining  engine 
on  a  subsequent  hit  causes  an  aircraft  kill. 

Three  methods  are  presented  below  to  shew  the 
effects  cf  multiple  hits:  The  kill  tree  diagram,  the  state 
transition  matrix  {or  Markov  chain)  method,  and  a  simplified 
approach.  The  first  method  is  more  of  an  instructional 
tocl,  whereas  the  transition  matrix  method  can  be  used  in 
complex  problems  beyend  the  practical  capability  of  the  kill 
tree  diagram.  The  simplified  approach  is  the  easiest  to 
use. 

(1)  The  Bill  Tree  Diagram.  The  sequence  cf 
events  explained  above  regarding  the  effects  of  multiple 
hits  can  be  illustrated  diagram latically  using  what  is  known 
as  a  kill  tree  diagram.  The  probability  of  kill  cf  each 
component  given  a  random  hit  on  the  aircraft  is  first 
computed  using  Equation  2.6,  then  the  kill  tree  diagram  is 
created.  To  simplify  the  explanation,  consider  the  nonre- 
dundant  aircraft  model  with  no  overlap  illustrated  in  Figure 
2.15  and  defined  in  Table  3. 

Ifte  Kill  Tree  Diagram.  Nonredundant  Model. 
Figure  2.19  presents  the  kill  tree  diagram  that  defines  the 
mutually  exclusive  kill  probabilities  of  each  nonredundant 
critical  component  (pilot,  fuel,  and  engine),  and  hence  the 
aircraft,  and  the  probability  that  no  critical  components 
are  killed  after  the  first  hit  cn  the  aircraft. 
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Figure  2. 19  First  Hit  Bonredundant  Kill  Tree 

In  Figure  2.19,  P  =  Pk/H^  •  *  -  ^/Hf  •  E  Pk/He  '  an<3  N 
represents  the  probability  that  no  critical  components  are 
hilled  and  is  given  bj  N  =  1-(E+F+E).  Note  that  P+F+E+N  is 
unity;  all  possibilities  have  been  accounted  for  on  this 
first  hit.  The  probability  the  aircraft  is  killed  on  this 
first  hit  is  given  by  P+F+E. 

Figure  2.20  represents  the  kill  tree 
diagram  after  the  second  hit.  PxP  represents  the  situation 
where  the  first  hit  killed  the  pilot,  and  the  second  hit 
also  killed  the  pilot.  It  is  important  to  note,  however, 
that  once  a  probability  of  kill  is  defined  for  each  critical 
component  on  the  first  hit,  that  component  is  considered 
killed  at  that  probability  valce  for  all  subsequent  hits. 
The  pilot  cannot  be  killed  twice.  The  four  branches  from 
that  kill  probability  for  the  second  hit  adds  nothing  new 
(no  additional  probability  of  pilot  kill)  to  the  seguence. 
This  fact  can  be  verified  by  examining  the  sum  of  the  kill 
probabilities  PxP  FxF  PxE  PxN,  which  is  the  same  as 
Px (P+F+E+N) .  Thus,  this  line  is  equal  to  the  probability 
calculated  for  P  on  the  first  hit  because  P+F+E+N  is  unity. 
The  only  addition  to  the  kill  probability  of  the  aircraft 
due  to  the  second  hit  comes  from  critical  components  not 
killed  on  the  first  hit.  This  concept  will  becose  clearer 
and  acre  important  when  redundait  components  are  discussed. 
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Figure  2.20  Second  Hit  lonredundant  Kill  Tree 


In  crder  to  illustrate  the  development  of 
a  kill  tree  diagram,  assume  the  numerical  values  for  the 
component  kill  probabilities  given  in  Table  3.  Figure  2.21 
illustrates  the  kill  tree  lor  the  first  hit.  The 


Figure  2.21  First  Hit  lonredundant  Kill  Tree  Exanple 


probability  the  aircraft  is  killed  after  the  first  hit  is 
the  sum  cf  the  kill  probabilities  for  each  of  the  critical 
components.  Thus, 

P(1)  =  .0133  ♦  .  06  OC  ♦  .  1000  =  0.  1733  (2.43) 

K/H 
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(2. 44) 


and  hence. 


=  1  -  0.  1733  =  0.8267 


Figure  2.22  extends  this  example  to  the 
second  hit.  The  probability  the  aircraft  is  killed  after 
the  second  hit  is  the  sum  of  the  additional  kill  probabili¬ 
ties  for  each  of  the  critical  components  for  the  second  hit. 
Thus, 


=  +  [0.8267  x  (.0133  +  .  0600  .  1000)  ]  (2.45) 

K/H 


and  hence. 


-  (2) 

PS/H  =  1 


-  .3166  =  .6834 


(2.46) 


F 

.0600 

Kill 


E 

.0100 

KILL 


N 

.  8267 


XxP 

,01099 

Kill 


RxF 

.04560 

Kill 


NxE 

.08267 

KILL 


Figure  2.22  Second  Hit  lonredundant  Kill  Tree  Example 


The  kill  tree  diagram  procedure  may  be 
continued  indefinitely  to  determine  PS/H  for  any  number  of 


hits.  Eowever,  the  probability  the  nonredundant  aircraft 
model  survives  a  sequence  of  hits  can  also  be  computed  using 
Equation  2.41.  For  the  nonredurdant  aircraft  model,  PK/H  is 
constant  as  explained  above.  Thus,  the  probability  the 
aircraft  survives  two  hits  is  given  by: 


Pc/i  =  (1  - 


O  ~  P  K/H  )  =  O  "  P  k/h) 


(2.47) 


or. 


_  (2) 
P  S/H 


(1  -  0.  1733)  2  =  0.  6834 


(2.  48) 


Note  that  this  value  is  the  sate  as  that  obtained  from  the 
kill  tree  diagram,  as  it  should  be. 

Equation  2.41  can  be  used  for  any  number 
of  hits  and  is  much  easier  to  use  than  the  kill  tree 
diagram.  The  essence  of  this  equation  is  that  all  cf  the 
nonredundant  critical  components  can  be  combined  intc  one 
composite  critical  component  whcse  vulnerable  area  is  52  ft2 
and  whose  PK/H  is  0.  1733  in  the  numerical  example. 

Sill  ~ree  Ciagram ,  Redundant  Kcdel. 
Consider  new  the  redundant  aircraft  model  shown  in  Figure 
2.17  and  defined  in  Table  7.  An  evaluation  for  and 
Ps/h  can  performed  in  a  manner  similar  to  the  previous 
discussion.  Although  the  engines  are  redundant  critical 
components,  each  must  be  shown  as  a  separate  branch  in  the 
kill  tree  diagram,  because  a  kill  of  an  engine  is  a  possihle 
outcome  of  an  aircraft  hit;  and  any  engine  kill  will  have  an 
effect  on  the  aircraft’s  vulnerability.  Figure  2.23  illus¬ 
trates  the  kill  tree  diagram  fci  the  first  hit.  Note  that  N 
now  represents  the  probability  that  no  nonredundant  or 
redundant  component  is  killed. 

The  logical  kill  expression  for  this 
redundant  aircraft  model  is  given  by  Equation  2.49. 
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Figure  2.23  First  Hit  Redundant  Kill  Tree  Example 


(Pilot)  .OR.  (Fuel  Tank)  .OR.  (2.49) 

[  (Engine  1)  .AND.  (Engine  2)  ] 


Because  the  first  hit  cannot  kill  both  engines,  the  prob¬ 
ability  that  the  aircraft  is  killed  after  the  first  hit  is 
just  the  sum  of  the  kill  p r cbabilities  for  each  of  the 
nonredundant  critical  component s '  (pilot  and  fuel).  Thus, 


-(1) 

PK/H 


0.0133  ♦  0.C600  =  0.0733 


(2.50) 


Figure  2.24  illustrates  the  event  prob¬ 
abilities  on  the  second  hit  after  a  kill  of  engine  1  on  the 
first  hit.  The  seguence  represented  by  killing  engine  1  on 
the  first  hit  and  then  killing  the  pilot  (0.00133),  or  fuel 
(0.06C0)  ,  or  engine  2  (0.01167)  on  the  second  hit  results  ir. 
additional  aircraft  frills.  Thus,  the  cumulative  probability 
of  an  aircraft  kill  is  due  tc  kills  of  the  nonredundant 
critical  components  as  well  as  kills  defined  by  component 
redundancy  restrictions.  The  five  branches  from  a  kill  of 
igine  2  and  from  the  N  branch  will  also  contribute  addi- 
onal  kills.  Thus,  after  two  hits,  the  cumulative  prcb- 
ility  of  kill  is  given  by  Eguetion  2.51. 
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Figure  2.28  Sanple  Component  Vulnerable  Area  Fori 

projectile,  or  in  a  sketch  of  the  aircraft  with  regions 
shown  and  the  region’s  presented  area  and  vulnerable  area 
summarized  on  an  acccipanying  fcrm. 

2.  Blast 


Aircraft  vulnerability  to  external  blast  is  usually 
expressed  as  an  envelope  about  the  aircraft  where  the  deto¬ 
nation  of  a  specified  charge  *eight  of  spherical  uncased 
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Figure  2.27  Total  Aircraft  Single  Hit  Vulnerable  For® 


components  for  each  combination  of  threat,  kill  category, 
and  striking  aspect  assessed  with  the  striking  velocity 
varying  from  500  to  3500  ft/sec.  Manual  assessments  for 
nonexplcsive  projectiles  will  te  performed  for  at  least  the 
six  major  views  of  the  aircraft.  A  computerized  assessment 
will  be  performed  fcr  at  least  the  six  major  views  and 
usually  for  a  total  cf  26  views  spread  at  45  degree  incre¬ 
ments  of  elevation  and  azimuth  as  described  earlier.  A 
typical  total  aircraft  single  hit  vulnerable  area  summary 
form  is  shewn  in  Figure  2.27.  Multiple  hit  vulnerable  area 
curves  similar  to  the  one  showi  in  Figure  2.26  should  also 
be  presented  for  at  least  six  aspects. 

In  addition  to  the  total  aircraft  Ay  presenta¬ 
tion,  the  vulnerable  area  of  each  critical  component  should 
also  be  listed,  and  both  the  true  and  the  incremental  vuln¬ 
erable  areas  should  be  presented  for  overlapping  components. 
Redundant  components  should  be  identified,  and  the  number  of 
redundant  components  that  must  be  killed  to  cause  an 
aircraft  kill  should  be  noted.  The  single  hit  vulnerable 
area  associated  with  overlapping  redundant  components  should 
also  te  identified.  Figure  2.28  shows  a  sample  component 
vulnerable  area  summary  form. 

For  explosive  projectiles  and  contact  fuzed 
missiles,  vulnerability  data  normally  will  be  presented  as 
summary  forms  of  the  total  Av  of  nonredundant  components  for 
each  combination  of  threat,  kill  category,  and  aspect  angle 
assessed.  These  results  usually  are  not  presented  as 
varying  with  the  fragment  striking  velocity.  Each  major 
redundant  component  will  be  shown  separately  if  assessed. 
Assessments  will  be  performed  for  at  least  the  six  major 
views  and  for  26  views  if  possible.  For  HE  projectiles,  in 
addition  to  the  total  aircraft  vulnerable  area,  the  contri¬ 
bution  by  subsystem  or  aircraft  region  should  also  be 
presented.  This  can  be  done  similar  to  the  nonexplcsive 
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gure  2.26  Vulnerable  Area  vs  Nunfcer  of  Hits 


(2.61) 


(n)  -(n)  -  (n-1) 

1  ~  PK/H  =  ^S/H5  /  (PS/H  } 


Equation  2.61  can  alsc  be  given  in  the  form: 


(n)  -(n)  -(n-1) 

1-p  =  (1  -  p  )  /  (1  -  P  ,  ) 

K/H  K/H  K/H 


(2.62) 


and  hence. 


(n)  (-(n)  _  ~  (n-1)  j  /  (1  _  p(n_1)' 

K/H  K/H  K/H  K/H 


(2. 63) 


The  vulnerable  area  for  the  nth  hit.  Ay  ,  is  computed  using 
the  given  by  Equation  2.63  and  the  basic  vulnerable 
area  equation.  Equation  2.1.  Thus, 


,  (n)  ,—  ( n ) 

A  =  (A  )  (P  ) 
V  P  K/H 


(2. 64) 


Figure  2.26  shows  the  Av  for  the  redun¬ 
dant  model  PK/H  given  in  Figure  2.25.  Note  that  the  Av  is 
just  the  sum  of  the  vulnerable  areas  of  the  nonredundant 
components.  Note  also  the  asymptotic  behavior  for  the 
redundant  model.  The  constant  vulnerable  area  of  the  ncnre- 
dundant  aircraft  given  in  Table  3  is  also  plotted  in  Figure 
2.26  for  the  purpose  cf  comparison.  Note  that  the  vulner¬ 
able  area  of  the  redundant  aircraft  is  less  than  that  of  the 
nonredundant  aircraft  (with  the  30  ft2  vulnerable  area 
engine)  for  the  first  fifteen  hits.  On  subsequent  hits,  the 
vulnerable  area  is  slightly  larger  due  to  the  fact  that 
there  is  a  strong  likelihood  that  one  or  the  other  of  the 
two  engines  has  been  killed,  aid  the  benefits  of  redundancy 
have  teen  eliminated. 


c.  Presentation  of  Pesclts 

Nonexplcsive  projectile  results  normally  will  be 
presented  in  summary  forms  cf  total  A,  of  nonredundant 
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aircraft  designs  due  to  its  dependence  on  the  physical  size 
of  the  aircraft.  If  two  aircraft  have  identical  vulnerable 
areas,  hut  different  presented  areas,  the  one  with  the 
largest  presented  area  will  appear  to  be  less  vulnerable 
because  its  cumulative  probability  of  kill  given  n  hits  will 
be  less  than  that  of  the  aircraft  with  the  smaller  presented 
area.  Cn  the  other  hand,  beinc  larger,  it  may  suffer  more 
hits;  that  is,  it  may  be  more  scsceptible. 

The  measure  that  is  the  most  meaningful 
for  vulnerability  assessment  and  comparison  of  designs  is 
vulnerable  area.  For  nonredundant  aircraft,  the  probability 
of  kill  given  a  hit  and  the  vulrerable  area  are  constant  for 
each  and  every  hit.  Each  subsequent  hit  has  just  as  much 
chance  of  killing  the  aircraft  as  the  previous  hit  (assuming 
component  degradation  is  neglected) .  However,  this  is  not 
true  for  aircraft  with  redundart  critical  components.  For 
these  aircraft,  the  probability  of  kill  given  a  hit  and  the 
corresponding  vulnerable  area  changes  with  each  hit  because 
of  the  increasing  possibility  of  the  loss  of  one  or  mere  of 
the  redundant  components.  In  erder  to  compute  the  multiple 
hit  vulnerable  area,  an  event-based  probability  cf  kill 
given  a  hit  must  be  computed  for  each  hit.  In  general,  the 
probability  of  aircraft  survival  after  taking  n  hits  was 
given  by  Equation  2 .  *1 1  which  is: 


-(n)  ,,  {lK  M  J2), 

Ps/H  =  1-PK/H  1_PK/H 


(n)  , 

(1_pk/h) 


(2. 59) 


which  alsc  can  be  expressed  in  the  form: 


(p 


(n-l) 

S/H 


(1-"PK/!i) 


(2.60) 


The  value  desired  in  Equation  2.60  is  ,  the  event-based 
probability  that  the  aircraft  is  killed  on  the  nth  hit  on 
the  aircraft  given  that  it  has  survived  the  first  (n-1) 
hits.  Rearranging  terms  in  Equation  2.60  gives: 
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-  (n) 
P 

S/H 


,,  -  (n) 
(1-P 

k/H 


.  -Cn) 

)  1-P 

k/H. 


-  (n) 

) (1-(P  , 
k/H 


el 


.  -  (n) 
)  P 

k/H 


)) 


e2 


vhere 


(2.56) 


Pk/Hp  1  "  (1_Pk/Hp)  '  Pk/Hf  ~  1  ~  (1"Pk/Hf’ 


and 


(2.57) 


(p<n) 

k/H 


el 


)  (P(n) 
k/H 


)  =  (1-U-P. 


e2 


k/H 


r )  (i- (i-p 


el 


'  k/H 


)n) 


e2 


(2.58) 


according  to  Equation  2.40.  Table  10  presents  the  P^/h  for 
both  the  transition  matrix  method  and  the  simplified 
approach  for  several  values  of  n.  Hote  that  the  approximate 
is  both  lover  than  and  hicher  than  the  correct  ansver 
and  that  the  approximate  kill  probability  is  reasonably 
close  to  the  correct  value,  for  this  example. 


TABLE 

10 

A 

Comparison  oi 

Aircraft 

Kill  Probabilities 

Hits, 

n 

1 

3 

5 

10  20 

*  (n). 

c  K/H 

Correct 

.0733 

.2615 

.  4456 

.7619  .9640 

~(n)_ 

K/H 

Approximate 

.0833 

.  2693 

.  4436 

.7470  .9567 

(4)  Multiple  flii  Vulnerable  Area.  The  cumula¬ 
tive  probability  of  kill  given  n  hits  derived  above  is  not 
necessarily  the  best  measure  for  assessing  or  comparing 
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percent  probability  that  engine  1  has  been  killed,  a  17.93 
percent  probability  that  engine  2  has  been  killed,  and  a 
50.41  percent  probability  that  none  of  the  critical  compo¬ 
nents  have  been  killed.  Thus,  after  the  second  hit: 

P(2)  =  0.1413  ♦  0.C233  =  0.  1646  (2.55) 

K/H 

This  value  is  the  same  as  that  obtained  from  the  kill  tree 
diagram  after  the  second  hit,  as  it  should  be.  This  process 
can  easily  be  continued  for  as  nany  hits  as  desired.  Figure 
2.25  shows  the  P^/h  as  a  funct*on  of  n  f°r  both  the  redun¬ 
dant  aircraft  model  and  the  nonredundant  aircraft  model 
given  in  Table  3.  The  differerce  between  the  two  curves  is 
the  reduction  in  vulnerability  due  to  redundancy. 

In  the  above  presentation,  the  transition 
matrix  was  assumed  to  be  the  same  for  all  hits.  This 
assumption  is  not  necessary.  If  multiple  damage  mechanisms 
hit  the  aircraft  frcn  several  different  aspects,  a  tran¬ 
sition  matrix  can  te  constructed  for  each  aspect  of 
interest.  The  computation  of  the  state  vector  for  the  j* 1 
hit,  given  by  Eguaticn  2.53,  would  use  the  transition  matrix 
for  the  approach  direction  of  that  particular  hit.  Another 
possible  modification  is  the  ccrsideration  of  an  increase  in 
P  due  to  multiple  hits.  Again,  [T]  could  te  changed 

K/Hi 

from  cne  hit  to  the  next. 

(3)  1  Simplified  Approach.  If  the  probability 
cf  survival  of  each  of  the  critical  components  after  n  hits 
on  the  aircraft  is  known,  an  approximation  for  the  prob¬ 
ability  the  aircraft  has  been  killed  by  the  n  hits  can  be 
obtained  by  neglecting  the  mutually  exclusive  feature  of  the 
individual  component  kills  on  any  one  hit.  Thus,  for  the 
example  redundant  component  aircraft  model,  Eguaticn  2.30 
can  be  used.  Eguaticn  2.30,  for  the  n  hit  situation,  is 
given  by  Eguation  2. 56. 
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and  Krc 


where  Knrc  and  Krc  are  the  probabilities  the  aircraft 
is  in  these  two  states  after  n  hits. 

Osing  the  numbers  generated  in  the 
previous  numerical  example,  consider  the  first  hit.  Prior 
to  the  first  hit,  the  aircraft  is  entirely  in  the  NK  state. 
Thus,  according  to  Eguation  2.52: 


*  m  cs]  =  [t] 


Carrying  out  the  matrix  multiplication  gives: 


0.0773 
0. 1000 
0.1167 


0.7100 


Knrc 


Thus, 

hit: 


=  0.0733  as  before.  Similarly,  for  the  second 


0.0733 


C.1000 

=  [T]  [S](1)  =  [T]  0.1167 


[_0.7100_J 

Carrying  out  the  matrix  multiplication  gives: 

0.1413  Knrc 

0.1520 

(2) 

[S]  *  0.1793 

0.0233 

0.5401J  Krc 

Note  that  the  sum  of  the  elements  of  [S]  is  unity,  as  it 

12) 

should  be.  The  [Sj  vector  results  reveal  that  after  the 
second  hit  there  is  a  14.13  percent  probability  that  either 
the  pilot  or  the  fuel  tank  or  both  have  been  killed,  a  15.20 
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Krcl)  is  the  sum  of  engine  I’s  probability  of  kill  given  a 
hit  on  the  aircraft,  El,  and  that  of  the  remaining  "else¬ 
where”  area  of  the  aircraft,  N .  Transitioning  from  Krcl  to 
Krc2  is  zero  because  a  kill  of  the  second  engine  after  the 
first  engine  is  killed  defines  the  state  Krc.  Thus,  the 
state  transitions  frcn  Krcl  to  Krc  according  to  the  condi¬ 
tional  probability  of  kill  of  the  second  engine,  E2,  and  so 
on. 

Let  the  probability  that  the  aircraft 
exists  in  each  of  the  five  possible  states  after  the  jth  hit 
he  expressed  by  a  vector  [S](^  ,  where 

Knrc 
Krc  1 

fS1<j)  =  Krc  2 


Note  that  the  sum  of  the  elements  in  [S]  J  is  always  unity; 
the  aircraft  must  exist  in  one  of  these  five  states.  The 
probability  the  aircraft  is  in  each  one  of  the  five  states 
after  the  (j+1) th  hit  is  given  by: 


[S]  (3+1)  =  [T]  [S]  h) 


(2.53) 


That  is,  the  aircraft  transitions  from  [S]^  to  [S](-’+1) 
according  to  [  T]. 

An  aircraft  kill  is  defined  by  those 
states  that  specify  either  a  kill  of  any  of  the  nonredundant 
components  or  a  kill  cf  enough  members  of  the  sets  of  redun¬ 
dant  components,  such  as  both  engines.  In  this  example, 
Knrc  and  Krc  specify  the  kill  states.  Hence,  the  prob¬ 
ability  the  aircraft  is  killed  after  n  hits  is  given  by: 


P  (n) 
K/H 


Knrc 


♦  Krc 


(2. 54) 
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A  transition  matrix  of  probabilities,  [I], 
can  now  be  constructed  to  specify  how  the  aircraft  will 
I  transition  from  one  state  to  another  due  to  a  hit  cn  the 

aircraft.  Table  9  illustrates  the  computation  of  the  [T] 
matrix  for  the  example  redundant  aircraft  model  defined  in 
|  Table  7.  Each  element  of  the  matrix  represents  the 


TABLE  9 

Computation  of 

the  State 

Transition  Matrix 

Probability  cf 
this  state 

transitioning  from 

Knrc 

Krc  1 

Krc2 

Krc 

NK 

to  this 
state 

300 

4  +  18 

4+18 

0 

4+18 

Knrc 

1 

0 

30+213 

0 

0 

30 

Krc  1 

30C 

0 

0 

35+213 

0 

35 

Krc2 

0 

35 

30 

300 

0 

Krc 

'  0 

0 

0 

0 

213 

NK 

Note  that 

the  sum 

of  each  column  is 

unity 

probability  of  transitioning  from  the  state  defined  by  tte 
column  locations  to  the  new  state  defined  by  the  rcw  loca¬ 
tion.  The  matrix  is  read  as  follows.  The  probability  of 
the  aircraft  transitioning  fro  a  the  Knrc  state  to  the  Knrc 
state  is  unity  (300/300)  because  Knrc  is  an  absorbing  state. 
The  probability  of  transitioni rg  from  the  Krcl  state  (kill 
of  engine  1)  to  the  Knrc  state  (kill  of  a  nonredundant 
component)  is  the  sum  of  the  conditional  probabilities  of 
kill  cf  the  two  nonredundant  coeponents,  that  is,  P+F.  The 
probability  of  transitioning  frcm  Krcl  to  Krcl  (remaining  in 
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(2)  The  State  Transition  Matrix  Method  (Markov 
Chain).  Briefly,  the  state  transition 
matrix  method  assumes  that  a  sequence  of  independent  events 
(random  hits  on  the  aircraft)  can  be  modelled  as  a  Markov 
process.  In  a  Markov  process,  the  aircraft  is  defined  to 
have  two  or  more  states  in  which  it  may  reside,  and  the 
probability  of  an  aircraft  kill  due  to  the  j+1  hit  is  the 
probability  that  the  j+1  hit  on  the  aircraft  will  cause  the 
aircraft  to  transition  from  a  non-kill  state  after  j  hits  to 
a  kill  state.  The  sequential  process  of  evaluating  the 
probability  the  aircraft  exists  in  each  of  the  several 
possible  states  after  hits  1,  2,  3,  ...,  J  is  based  upon  the 
probability  the  aircraft  existed  in  each  of  the  possible 
states  after  hits  0,  1,  2,  ...,  J-1,  respectively,  and  is 

referred  tc  as  a  Markov  chain.  Bather  than  dwell  on  the 
mathematical  theory,  an  example  using  the  previously  defined 
redundant  aircraft  model  will  serve  much  better  tc  illus¬ 
trate  the  methodology. 

An  aircraft  consisting  of  a  pilot,  a  fuel 
tank,  and  two  engines  can  exist  in  five  distinct  states: 

1.  One  or  more  of  the  nonredundant  critical  components 
(the  pilot  and  the  fuel  talk)  have  been  killed, 
resulting  in  an  aircraft  kill,  denoted  by  Knrc. 

2.  Only  engine  1  has  been  killed,  denoted  by  Krcl. 

3.  Only  engine  2  has  been  killed,  denoted  by  Krc2. 

4.  Both  engine  1  and  engine  2  have  been  killed, 
resulting  in  an  aircraft  kill,  denoted  by  Krc. 

5.  None  of  the  nonredundant  critical  components  and 
neither  of  the  engines  are  killed,  denoted  by  NK. 

States  Knrc  and  Krc  are  called  absorbing  states  because  the 
aircraft  cannot  transition  from  these  two  kill  states  tc  any 
of  the  ether  three  non-kill  states. 
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Figure  2.24  Second  Hit  After  First  Hit  on  Engine  1 


-(2) 

Pk/h  =  -0733  +  [ -1000  x  (.0132  +  .0630  +  .1167)]  (2.51) 

♦  [.  1167  x  (.0133  +  .0600  +  .1000)] 

♦  [.  7100  x  (.  0133  ♦  .0600)]  =  0.1646 

and  hence: 

-  0. 1646  =  0.8354  (2.52) 

significant  increase  in  survivability  (C.8354 
versus  0.6834)  after  the  second  hit  due  to  the  addition  of 
the  second  engine. 

This  procedure  can  be  continued  indefi¬ 
nitely,  as  in  the  nonredundant  case,  but  it  is  obvious  that 
the  computations  quickly  become  overwhelming  in  complexity. 
The  state  transition  matrix  method  described  below  is  better 
suited  tc  handle  the  problem. 


?<2) 

S/H 


=  1 


Note  the 


pentolite  high  explosive  will  result  in  a  specified  level  of 
damage  or  kill  to  the  aircraft.  Detonation  outside  of  such 
an  envelope  will  result  in  little  or  no  damage  to  the 
aircraft  or  in  a  lesser  kill  level.  The  damage  mechanism  is 
the  Hast  resulting  from  the  detonation  of  the  high  explo¬ 
sive  in  the  vicinity  cf  the  aircraft.  A  spectrum  of  charge 
weights  are  often  specified  for  which  the  aircraft  vulner¬ 
ability  measures  are  computed  in  the  vulnerability  assess¬ 
ment.  The  specific  charge  weights  selected  are 
representative  of  the  expected  threat  warheads  which  might 
be  encountered.  Envelopes  are  determined  for  a  variety  of 
encounter  conditions  which  account  for  variations  in 
aircraft  speed  and  altitude,  as  well  as  aspect.  Aircraft 
critical  components  vulnerable  to  the  external  blast  consist 
principally  of  portions  of  the  airframe  structure  and 
control  surfaces.  Threshold  kill  criteria  for  the  critical 
components  are  derived  from  structural  and  aerodynamic  anal¬ 
yses.  Cnee  the  blast  pressures  and  impulse  levels  reguired 
for  a  component  kill  are  determined  for  several  locations  on 
the  aircraft  surface,  a  contour  may  be  plotted  corresponding 
to  the  detonation  distance  and  the  weight  of  pentolite  which 
will  provide  the  reguired  overpressure  and  impulse  level. 
Two  different  graphical  presentations  of  the  data  may  be 
used.  The  first  is  a  plot  of  charge  weight  versus  distance 
for  a  constant  kill  level.  Several  curves  can  be  drawn  on 
the  same  graph,  one  for  each  altitude  of  interest.  A 
similar  graph  is  reguired  at  each  azimuth  and  elevation 
angle  of  interest  about  the  aircraft.  Figure  2.29  is  an 
example  cf  this  type  cf  presentation.  The  second  graphical 
method,  illustrated  in  Figure  1.30,  is  to  construct  iso¬ 
charge  weight  contours  about  the  aircraft  for  a  given  kill 
level  and  altitude  in  all  planes  of  interest. 
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Figure  2.29  Typical  External  Blast 
vulnerability  Data  Presentation 

3 .  Endgame  Analysis 

The  probability  of  an  aircraft  kill  due  to  the  burst 
of  a  specific  warhead  for  a  particular  set  of  encounter 
conditions,  PK/D  ,  is  dependent  upon  how  many  fragments  hit 
the  aircraft  and  the  aircraft's  vulnerability  tc  the 
multiple  hits.  The  number  of  fragments  which  strike  the 
aircraft  was  derived  in  the  previous  chapter  and  the 
aircraft's  vulnerability  to  multiple  hits  was  discussed  in 
the  previous  section.  The  PK,D  3ue  to  the  n  hits  on  the 
aircraft  is  analogous  to  the  P^9/i  derived  in  this  chapter 
earlier.  Thus,  PK/D  can  he  estimated  using  cumulative 
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Fiqure  2.30  Typical  External  Blast  K-Kill  Contour  for 
Various  Weights  cf  uncased  Pentolite  at  Sea  Level 


probability  of  kill  curves  similar  to  the  one  shown  in 
Figure  2.25.  Simplified  equations  for  PK/D  in  terms  of  the 
aircraft  vulnerable  area  and  the  n  hits  are  derived  fcelcw. 

The  probability  the  aircraft  is  killed  given  the  jth 
random  hit  by  a  single  fragment,  PK/H •  can  be  determined 
using  the  procedure  described  in  this  chapter.  The  prob¬ 
ability  that  the  aircraft  is  killed  by  the  n  independent, 
random  hits  from  detonation,  Pk/h  '  9i-ven  fcy  Equation 
2.42.  Therefore, 


p  =  p 
*K/H  *K/D 


n 

n  (i 

3  =  1 


<3> 

PK/H 


(2.65) 
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It  can  te  shown  that  for  small  P !/*,  # 


11  (1  PK/HJ  exp('"PK/H)  (2-66) 

j=l  j=l 

further  mere/ 


n 

E 

j  =  l 


P(j)  = 
K/H 


S  \ 
j  =  l 


(j) 


/  Ar 


(2. 67) 


Hence,  PK/D  can  be  given  in  the  form: 

PK/D  =  1  ~  exp(  p  /  n)  E  Av3  )  (2.68) 

j  =  l 

according  to  Equation  1.33.  If  there  are  no  redundant  crit¬ 
ical  components,  is  usually  assumed  to  be  a  constant 

value  for  all  hits,  and  PK/Q  simplifies  to: 


p  =  1  -  exp(-  p  a  )  (2.69) 

K/D  V 

An  example  of  the  computation  cf  P  for  an  encounter  is 

*  K/D 

given  in  Table  11. 

There  is  no  unique  value  for  PK/D  for  a  warhead 
detonation  at  a  specific  location  with  respect  to  the 

aircraft.  P  ,  will  be  different  for  detonations  at  the 

K/D 

same  distance,  but  at  different  locations  around  the 
aircraft.  Nevertheless,  the  aircraft's  vulnerability  to  an 
externally  detonating  warhead  is  often  indicated  only  with 
respect  to  the  distance  of  the  detonation  from  the  aircraft, 
without  regard  to  the  ether  variables. 

A  typical  curve  relating  PK/D  to  the  detonation 
distance,  R,  is  given  in  Figure  2.31.  This  curve  is 
referred  to  as  the  kill  function  given  a  detonation,  and  the 
radius  at  which  PK/D  is  equal  to  0.5  is  called  the  lethal 
radius  of  the  warhead.  The  value  of  PK/D  specified  for  each 
value  of  E  could  be  the  average  of  the  PK/D  's  computed  for 
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Figure  2.31  Typical  Probability  of  Kill 
Giyen  i  Detonation  Function 


TABU  11 

An  Example  Coarctation  for  P 

r  K/D 

Static  Warhead  Spray  angles,  o,  =  50,  cl.  =  120 
Parameters 


Dumber  of 

Fragment 

Encounter 

Parameters 

Fissile  s 

Fissile  a 

Eetonatio 

Aircraft 

Aircraft 

Parameters 

Aircraft 

Aspect  vu 

(to  fragm 
velocity 

Fragmentation 
Dynamic  Spray 

't>1  =  Tan- 

Angles 

<f>2  =  Tan- 

Fragment 

Spray  Density 

P  =  1000 

p  =  .0235 

Probability 
of  kill 

fk/d  =  1 
ek/d  = 

fragments,  N  =  1000 
velocity,  Vj_  =  7000  fps 

peed,  Vm  =  1500  fps 
ncle,  9  =  30 
n  distance,  R  =  80  ft 
speed,  7t  =  1000  fps 

presented  length  =  50  ft 

lnerable  area,  Ay  =  25  ft2 

ert  size  and  striking 
under  consideration) 

1 [7644  /  1515]  -  30 
*[4250  /  -5763]  -  30 

/  [2  X  x  802  x  1.059] 
fragments/f t2 

-  exp  (-0.0235  x  25) 

44 


several  different  encounters  at  R,  or  the  PK/D  values  could 
be  weighted  with  respect  to  the  expected  probability  of 
encounter  occurrence  in  order  tc  obtain  a  weighted  average. 
For  exaaple,  if  a  certain  missile  only  approaches  the 
aircraft  from  the  rear  aspect,  only  PK/D  values  for  that 
type  of  encounter  would  be  competed. 
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E.  Y01NEBABILITY  TO  INTERNALLY  DETONATING  HE  BARHEADS 


Anti-aircraft  projectiles  2Cmm  and  larger  often  have  an 
HE  core  with  a  contact  fuze  that  detonates  the  warhead 
either  immediately  or  shortly  after  impacting  the  aircraft. 
This  results  in  a  detonation  on  or  inside  the  aircraft,  with 
the  accompanying  blast  and  fragment  spray  in  many  direc¬ 
tions.  The  assumption  of  parallel  trajectories  or  s.hotlires 
through  the  aircraft  used  in  the  nonexplosive  penetrator 
vulnerability  assessment  is  net  valid  in  this  situation. 
Instead,  the  fragment  shotlines  emanate  radially  from  the 
location  of  the  warhead  burst  point.  The  probability  of 
kill  of  any  critical  components  that  lie  on  any  of  the 
radial  fragment  shotlines  needs  to  be  evaluated  and  the 
aircraft's  vulnerable  area  and  probability  of  aircraft  kill 
given  a  hit  computed. 

There  are  several  approaches  to  this  problem.  Cne 
simple  approach  is  to  expand  the  presented  area  of  each  of 
the  critical  components  beyond  the  actual  physical  size  of 
the  component,  and  then  treat  a  hit  by  the  HE  round  in  the 
expanded  area  in  the  same  manner  as  that  used  for  the 
nonexplosive  penetrator.  For  example,  the  presented  area  of 
the  pilot  could  be  the  entire  cockpit,  because  any  hit  and 
detonation  within  the  cockpit  cculd  kill  the  pilot.  Figure 
2.32  illustrates  this  approach.  If  the  expanded  areas  of 
two  or  acre  components  intersect  or  overlap,  the  procedure 
for  accounting  for  overlapping  components  described  above 
must  be  used. 

In  another  procedure,  the  warhead  detonation  is  assumed 
to  take  place  at  individual  locations  within  a  grid  superim¬ 
posed  cn  the  presented  area  of  the  aircraft,  as  illustrated 
in  Figure  2.33.  Each  cell  contains  one  randomly  located 
hurst  point.  The  probability  of  killing  the  aircraft  is 
then  evaluated  for  each  burst  point.  This  kill  probability 
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Figure  2.32  The  Expanded  irea  Approach 


will  1 €  dependent  upcn  the  relative  location  of  the  adjacent 
critical  components  and  on  any  shielding  of  these  components 
provided  by  intervening  structure  and  non-critical  compo¬ 
nents.  Critical  components,  or  parts  of  critical  compo¬ 
nents,  cutside  of  the  cell  in  which  the  burst  occurs  must 
also  be  considered  when  they  can  be  hit  and  killed  by  the 
damage  mechanisms.  Note  that  several  redundant  critical 
components  can  possibly  be  killed  by  the  single  HE  burst. 
The  burst  point  kill  probability  is  determined  using  the 
kill  expression  for  the  aircraft.  However,  because  mere 
than  cne  critical  component  can  be  killed  given  a  single 
burst,  the  individual  component  kills  are  not  exclusive;  a 
single  burst  could  kill  both  the  fuel  system  and  the  pilot. 
Thus,  the  approach  used  in  the  overlapping  component  model 
to  compute  Pk^h  must  also  be  used  here.  The  probability  of 
an  aircraft  kill  given  a  random  hit  from  the  attack  aspect 
under  consideration  is  obtained  by  multiplying  the  prob¬ 
ability  of  aircraft  kill  given  a  hit  computed  for  each  burst 
point,  PK/H b,  by  the  probability  of  a  random  shot  hittirg 
the  burst  point  area,  P^ .  The  latter  probability  is  given 
by; 


=  *by/^D  •  t  =  1,  2,  ...,  B 

b  p 


(2.70) 


where  E  is  the  number  of  burst  points  or  cells  considered, 
and  is  the  local  grid  cell  area  around  each  burst  point. 
Note  that  even  though  critical  components  outside  of  the 
cell  are  included  in  EK/,H  ,  just  the  area  of  the  cell  itself 
is  used  in  the  computation.  The  PR/H  for  the  aircraft  given 
a  random  hit  is  giver  by: 


p 

K/H 
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b=l 


)  (P 


K/Hv 


A 
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B 
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b=l 


( A  )  ( P  , 
b  K/H. 


(2.71) 


where  A 


is  the  vulnerable  area  of  the  bth  cell. 


r 
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The  aircraft  vulnerable  area  is  computed  using: 

\  *  *b  (PK/H  >  =  “  V  (2-72) 

b=l  b  b=l  b 

which  is  the  sum  of  the  vulnerable  area  of  the  individual 
cells . 

The  vulnerable  area  for  internally  detonating  HE 
warheads  is  usually  much  larger  than  the  vulnerable  area  for 
nonexplcsive  projectiles  and  fragments,  but  it  can  never 
exceed  the  aircraft's  presented  area. 

F.  V0LKEHAEI1ITY  TO  USERS 

Because  a  laser  beam  must  hit  an  aircraft  to  damage  it, 
and  because  no  high  explosive  charge  is  involved,  the  meth¬ 
odology  for  assessing  the  vulnerability  of  aircraft  to 
lasers  consists  of  essentially  the  same  procedure  as  used  in 
the  assessment  of  aircraft  vulnerability  to  the  single 
nonexplosive  penetratcr. 

Laser  vulnerability  is  particularly  threat  sensitive. 
The  first  step  of  the  assessment  consists  of  developing  a 
description  of  the  target.  Foreign  intelligence  data  and 
mirror  technology  are  used  to  describe  the  target.  From 
this  data  a  computerized  target  description  is  generated, 
allowing  the  critical  components  and  their  failure  modes  to 
be  identified.  The  second  step  of  a  laser  vulnerability 
study  is  to  accumulate  data  on  the  energy  density  reguired 
to  produce  failure  of  the  critical  components,  and  energy 
density  data  on  the  barrier  materials  which  shield  the  crit¬ 
ical  components.  From  this  data,  burn  through  times  are 
calculated  as  a  function  of  laser  beam  intensity,  power, 
type  of  material,  and  thickness  using  a  parametric  penetra¬ 
tion  eguation.  A  shotline  program,  using  the  computerized 
target  description,  is  used  to  determine  the  critical 
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the  results  are  not  to  be  treated  as  sacrosanct-  The  output 
is  no  more  valid  than  the  assumptions  that  were  used  to 
develop  the  model  and  the  input  data.) 

Computerized  techniques  for  vulnerability  estimates  for 
nonexplcsive  projectiles  and  single  fragments  are  currently 
in  wide  use.  A  prerequisite  for  performing  such  analyses  is 
the  generation  of  a  geometric  model  of  the  aircraft 
describing  all  of  the  critical  components  and  the  major 
structure  and  nonvulnerabl e  components  that  provide 
shielding  for  the  critical  components.  The  computer  is  then 
programmed  to  project  shotlines  (parallel  rays)  through  this 
model,  from  selected  viewing  aspects  to  provide  a  sequential 
listing  of  penetration  data  for  input  to  a  computerized 
vulnerability  analysis. 

1  -  Shotline  Generators 

These  programs  generate  shotline  descriptions  of 
aircraft  targets  for  use  as  input  data  to  the  codes  which 
calculate  vulnerable  area.  The  programs  usually  model  the 
aircraft  external  surface  and  the  individual  internal  and 
external  components  either  with  a  set  of  geometric  shapes  or 
with  surface  patches.  The  target  geometric  information 
required  to  assess  tie  vulnerability  by  computer  program  is 
generated  mathematically  by  superimposing  a  planar  grid  over 
the  target  model  and  by  passing  a  large  number  of  parallel 
rays  through  the  target  from  the  attack  direction  to  the 
ether  side  (normal  to  the  grid)  through  individual  grid 
cells,  as  shown  in  Figure  2.34.  The  position  and  number  of 
rays  is  determined  by  means  of  the  superimposed  grid.  Ihe 
number  of  rays  is  controlled  b 5  selecting  the  size  of  the 
individual  squares  of  the  grid.  One  shotline  is  randomly 
located  within  each  cell.  Each  ray-surface  encounter  is 
listed  sequentially  ard  identifies  the  ray  location,  surface 
identification  number,  thickness,  obliquity  angle,  airspace 
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encountered,  and  distance  between  internal  surfaces.  This 
procedure  is  repeated  for  all  shotlines  originating  from  the 

selected  attack  directions.  Also  the  A  of  designated 

P 

components  and  of  the  overall  target  is  output  fcr  each 
viewing  aspect.  The  Ap  is  approximated  by  multiplying  the 
number  of  rays  intersecting  the  target  by  the  area  of  the 
individual  cells  making  up  the  grid  plane. 

Two  families  of  shotline  generator  routines  have 
been  developed.  They  are  the  MAGIC ,  GIFT  family  anc  the 
SHOTGEN,  FASTGEN  family.  The  MAGIC  and  GIFT  codes  were 
developed  at  the  U.£.  Army  Ballistic  Research  Laboratory, 
Aberdeen  Proving  Ground,  MD .  These  codes  use  the  combinato¬ 
rial  geometry  approach,  with  basic  body  shapes  such  as 
spheres,  boxes,  cylinders,  ellipsoids,  and  cutting  or 
bounding  planes,  tc  describe  components.  GIFT  is  an 
improved  version  of  MAGIC,  with  simpler  input  requirements, 
more  efficient  computation,  aEd  computer-generated  graphic 
displays.  The  second  family,  SHOTGEN  and  the  mere  recent 
FASTGEN  and  FASTGEN  31,  is  somewhat  similar  to  the  ether 
family,  but  typically  uses  the  flat  triangular  patch  method 
to  describe  the  component  surfaces.  SHOTGEN  was  developed 
by  the  Naval  Weapons  Center,  and  FASTGEN  and  FASTGEN  II  are 
improved  versions  of  SHOTGEN  sponsored  by  the  Air  Force 
Aeronautical  Systems  Division  (JSD)  .  Figure  2.35  shows  the 
external  view  of  a  model  built  using  the  combinatorial  geom¬ 
etry  approach,  and  Figures  2.36  and  2.37  show  the  external 
view  and  some  internal  components  of  a  flat  triangular 
surface  patch  model,  respectively. 

2.  Vulnerable  Area  Routines 

These  programs  generate  component  and  total  aircraft 
vulnerable  area  tables  for  a  single  penetrator  or  fragment. 
The  vulnerable  area  routines  car  be  divided  into  two  groups, 
the  "detailed"  or  analysis  routines,  which  use  the  shotline 
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Figure  2.35  Coitinatorial  Geometry  Model  of  an  Aircraft 


2.57  Internal  Components  Modeled 
Osicg  Triangular  Patch  Method 


approach  to  compute  the  vulnerable  area,  and  the  "siirpli- 
fied"  or  evaluation  routines  which  use  simplified  approaches 
to  determine  the  vulrerable  area.  The  routines  in  the  anal¬ 
ysis  group  are  usually  used  for  problems  reguiring  in-depth 
studies.  However,  they  have  the  potential  for  use  in  early 
design  studies  in  which  only  a  limited  amount  of  technical 
descriptive  data  is  available.  The  evaluation  routines  are 
more  appropriate  for  problems  in  which  a  cursory  analysis  is 
desired. 


a.  Analysis  Foutines 

The  programs  VABEA,  VARSA02,  and  COVART  belong 
to  the  detailed  group.  Inputs  to  these  programs  include  the 
shotline  descriptions  of  the  target  modei  generated  by  the 
shotline  programs,  probability  of  kill  given  a  hit  data  for 
the  individual  components,  empirical  ballistic  penetration 
data,  and  weapon  characteri s tics  data.  Component  and 
aircraft  single  hit  vulnerable  area  data  are  output  in 
tabular  form. 

VAREA  is  the  oldest  and  least  comprehensi ve  cf 
the  three  routines  in  this  group.  It  was  developed  in  1965 
by  the  Naval  Weapons  Center  to  conduct  vulnerability  anal¬ 
yses  cf  systems  subjected  to  fragmenting-type  threats  and 
uses  the  THOR  penetration  equations  to  compute  penetrator 
mass  and  velocity  decay  due  to  penetration  through  the 
components  along  the  shotline.  VAREA02,  completed  in  1973, 
evolved  from  the  VAREA  program.  Its  added  capabilities 
include  a  projectile  penetration  mode,  an  air  gap  fire 
model,  a  redundant  components  model,  and  an  option  tc  use 
the  DPI  penetration  equations  instead  of  the  THOR  relations. 

COVART  (Computation  of  Vulnerable  Area  and 
Repair  Time)  currently  represents  the  state-of-the-art  in 
vulnerable  area  routines.  It  incorporates  all  cf  the 
features  cf  the  VAREA02  program  and  the  helicopter 
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vulnerable  area  routines  from  the  HART  program  and  includes 
a  battle  damage  repair  time  model.  The  procedure  used  by 
COVAF T  tc  compute  single  hit  vulnerable  areas  is  essentially 
the  same  as  that  described  in  this  chapter  for  the  single 
nonexplosive  penetratcr  or  fragment.  The  component  vulner¬ 
able  area  of  each  cell  is  the  product  of  the  cell  presented 
area  and  the  probability  of  component  kill  for  the  shotline 
in  that  cell.  The  vulnerable  area  of  each  component  is  the 
sum  of  the  component  vulnerable  areas  computed  for  each  grid 
cell  whose  shotline  passes  through  the  component.  The  total 
aircraft  vulnerable  area  is  the  sum  of  all  of  the  cell  vuln¬ 
erable  areas,  considering  only  the  nonredundant  critical 
components  and  any  redundant  critical  component  overlap. 
Both  true  and  incremental  vu^.^erable  areas  are  available  for 
the  overlapping  components.  Fedundant  critical  components 
that  do  not  lie  along  the  same  shotline  do  not  contribute  to 
the  aircraft  vulnerability. 

b.  Evaluation  Routines 

The  computer  program  COMVAT  is  representative  of 
the  routines  which  belong  to  the  other  group,  the  simplified 
codes.  These  routines  were  developed  to  fulfill  the  need 
for  relatively  quick  methods  fcr  computing  vulnerable  area. 
They  are  intended  tc  be  used  it  situations  when  use  of  the 
more  sophisticated  routines  may  not  be  feasible  or  timely, 
such  as  during  early  conceptual  design  studies.  The  simpli¬ 
fied  routines  are  not  as  accurate  as  the  detailed  routines, 
tut  they  should  require  ccrsiderably  less  effort  and 
computer  run  time  to  use. 

COMVAT  was  developed  specifically  to  compute  the 
vulnerable  areas  of  aircraft  components  to  projectile 
threats.  It  is  based  upon  the  same  principles  as  the 
detailed  routines,  but  it  does  not  use  shotline  descriptions 
of  the  aircraft;  instead,  it  computes  component  vulnerable 


14  1 


areas  or  the  basis  of  inpct  data  describing  average 
shielding  conditions  cn  the  components.  The  THOR  penetra¬ 
tion  equations  are  used  to  model  projectile  velocity  decay. 
Secondary  effects  such  as  spalling,  projectile  yawing 
motions,  and  projectile  break-up  are  ignored. 

3.  Internal  Burst  Prog  rams 

Several  programs  for  computing  the  vulnerability  of 
aircraft  to  internally  detonating  HE  warheads  have  been 
developed  under  the  direction  of  the  Joint  Technical 
Coordinating  Group  for  Munitions  Effectiveness  (JTCG/ME) . 
These  programs  are  sometimes  referred  to  as  point  burst 
programs,  and  the  best  known  program  is  the  PCINTEUFST 
program.  This  program  uses  the  second  approach  described  in 
the  section  on  vulnerability  to  internally  detonating  HE 
warheads  which  is  the  point  burst  approach. 

4 .  Endgame  Programs 

The  Endgame  refers  to  the  terminal  events  in  an 
encounter  between  an  aircraft  and  an  HE  warhead  with  a  prox¬ 
imity  fuze.  Just  how  the  warhead  got  to  the  vicinity  of  the 
aircraft  is  irrelevant  to  the  Erdgame  analysis.  The  Endgame 
events  may  include  target  detection  by  the  fuze,  and  usually 
do  include  the  warhead  detonation,  blast  propagation,  and 
fragment  flyout,  impact,  and  penetration  through  the 
aircraft.  The  numerical  value  for  the  PK/D  is  then  deter¬ 
mined  for  the  given  set  of  encounter  conditions  and  warhead 
and  aircraft  characteristics.  This  procedure  is  usually 
repeated  for  many  different  sets  of  encounter  conditions  and 
warhead  detonation  points,  and  pk/d  established  as  a 
function  of  the  detonation  distance.  Four  Endgame  programs 
currently  in  use  are  SESTEM  II,  SCAN,  ATTACK,  and  REFMCD  or 
HECA.  A  fifth  program,  SHAZAM,  is  nearing  completion. 
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a.  SESTEM  II 

This  program  was  developed  in  1977  by  the  U.S. 
Air  force  Aeronautical  Systems  Division  to  evaluate  the 
terminal  effectiveness  of  missiles  with  nonnuclear  blast  and 
fragmentation  warheads  against  aerial  targets.  The  P  is 
computed  with  respect  to  a  direct  hit,  fragment  damage,  and 
blast.  The  program  has  the  capability  to  simulate  several 
fuzing  options  and  a  general  terminal  encounter  geometry. 
The  fragment  spray  angles  and  density,  and  fragment  average 
mass,  static  velocity,  cross-sectional  area,  and  coefficient 
of  drag  are  input  data.  The  target  is  represented  as  a 
collection  of  shapes  that  are  either  single  fragment  vulner¬ 
able,  masking,  or  fuzing  components.  The  external  shapes 
(wing,  fuselage,  etc.)  are  modeled  using  ellipses,  and 
rectangular  parallelpipeds  are  used  for  the  internal  compo¬ 
nents,  such  as  fuel  tanks  and  electronics.  The  vulner¬ 
ability  of  the  components  is  represented  by  vulnerable  area 
tables.  The  program  can  be  used  to  generate  iso-?K/D 
contours. 

t.  SCAN 

SCAN  was  developed  in  1976  under  the  supervision 
cf  the  D.S.  Navy  Pacific  Missile  Test  Center  (PMTC)  for  the 
Joint  Technical  Coordinatirg  Group  for  Aircraft 
Survivability  (JTCG/AS)  .  The  objective  of  SCAN  is  to 
predict  the  probability  that  an  aircraft  will  survive  an 
attack  by  a  missile  armed  with  a  warhead.  Aircraft  kills 
due  tc  direct  hit,  fragment  damage,  and  blast  are  evaluated. 
A  few  fuzing  options  are  considered,  as  well  as  a  general 
terminal  encounter  geometry.  The  warhead  is  divided  into 
polar  and  radial  zones  and  different  fragment  sizes,  shapes, 
and  materials  can  be  specified  within  each  zone.  The  target 
is  modeled  using  the  combinatorial  geometry  approach,  and 
component  vulnerability  to  single  fragments  is  expressed  by: 
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=  C  ♦  rc  x  Bass]  +  [C  x  Velocity] 

1  2  3 

where  mass  and  velocity  refer  to  the  fragment  mass  and 
velocity.  The  energy  density  ard  area  removal  kill  criteria 
are  alsc  options  for  use  with  components  such  as  major 
structures.  Each  component  is  given  a  material  and  thick¬ 
ness  and  is  linked  to  a  subsystem,  system,  or  aircraft  kill 
ly  a  logical  kill  expression,  thus  allowing  the  considera¬ 
tion  cf  redundancy.  SCAN  also  has  graphics  capabilities  for 
evaluation  of  the  input  geometric  model  and  output  fragment 
impact  data. 

c.  ATTACK 

ATTACK  is  a  Naval  Weapons  Center  revision  of  an 
Endgame  methodology  developed  at  the  Naval  Missile  Center, 
Point  Mugu.  The  object  of  ATTACK  is  to  predict  the  ability 
of  a  missile  to  detect  and  destroy  an  airborne  target. 
Direct  hit,  blast,  and  single  fragment  (component) ,  and 
multiple  fragment  (structural)  kills  are  considered,  and  a 
general  terminal  encounter  geometry  is  provided.  The 
warhead  in  ATTACK  uses  the  concept  of  polar  and  radial  frag¬ 
ment  spray  zones  and  fragment  weight  classes.  A  large 
number  of  fuze  options  are  available.  The  program  requires 
four  target  models,  one  for  each  type  of  damage,  and  one 
fuze  model  for  each  encounter.  The  components  in  the  single 
fragment  model  are  physically  represented  by  spheres  at 
specified  locations,  and  the  vulnerability  of  each  component 
is  contained  in  vulnerable  area  tables  that  depend  upon 
aspect  angle,  fragment  mass,  and  fragment  impact  velocity. 
The  multiple  fragment  model  uses  a  segmented  cylindrical 
target  representation,  and  the  vulnerability  of  each  segment 
is  specified  by  a  critical  level  of  fragment  energy  density. 
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a.  REFMOD  (MICA) 

The  REFMCD  program,  developed  in  1981,  was 
intended  tc  be  a  reference  model  to  be  used  for  computing 
the  effectiveness  of  externally  detonating  weapons  against 
moving  targets.  (It  was  later  renamed  Modular  Endgame 
Computer  Analysis  or  MECA) .  The  model  was  developed  under 
the  auspices  of  the  JTCG/ME  Anti-Air  Missile  Evaluation 
Group.  REF MOD  has  been  assembled  by  incorporating  methodol¬ 
ogies  from  many  other  existing  Endgame  programs,  including 
some  significant  additional  features  that  enable  it  tc  work 
with  a  wide  variety  of  vulner a lility  models  and  to  evaluate 
warhead-target  combinations  that  were  previously  too  cumber¬ 
some  to  assess.  The  warhead  types  considered  include  the 
continuous  rod,  divergent  fragment  spray,  convergent  frag¬ 
ment  spray,  focused  fragment  controlled  motion,  and  an 
aimable  warhead  in  which  the  fragment  spray  density  is  non- 
uniform  about  the  missile  axis.  Several  fuze  routines  are 
available,  and  the  option  exists  for  the  specification  of 
fuzing  data  from  flight  tests.  The  target  model  and  vulner¬ 
ability  employed  depend  upon  the  damage  mechanism  selected. 
These  include  direct  hit,  blast,  fragment,  and  continuous 
rod.  Component  vulnerability  types  for  fragments  include 
both  vulnerable  area  and  a  Pk/h  kill  criterion  that  is  a 
function  of  mass,  velocity,  and  density.  For  the  vulnerable 
area  model,  components  can  he  described  as  spherical, 
linear,  cylindrical,  or  planar  in  shape,  and  the  component 
vulnerable  area  tables  generated  by  COVART  can  be  used.  The 
Pk/h  vulnerability  model  employs  cylindrical  components,  and 
the  component  kill  criterion  is  given  by: 

c  c 

\/h  =  Cl  x  (Mass)  2  x  (Velocity)  3  (2.74) 
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with  lower  and  upper  threshcld  values.  By  inputting 
different  values  for  ,  C2  ,  and  C3  ,  a  variety  of  kill 
criteria  can  be  employed.  For  example,  when  C3  =  0.5,  C2  = 
1,  and  C  3 =  2,  the  energy  density  criterion  is  specified. 

e.  SHAZAM 

This  code  was  developed  at  the  Air  Force 
Armament  laboratory  (AFAT1/DLY)  for  the  evaluation  of  air- 
to-air  missile  effectiveness.  The  program  sequentially 
assesses  the  possibility  the  target  aircraft  is  directly 
impacted  by  the  missile,  the  effect  of  blast  overpressures 
upon  the  target  structures,  and  the  cumulative  effect  of 
warhead  fragment  impacts  on  the  target  structure  and  crit¬ 
ical  components.  The  size,  shape,  and  position  of  the 
target  tody  and  internal  components  are  described  by 
discrete  surfaces,  and  each  surface  can  be  vulnerable  to  a 
direct  hit,  to  blast,  or  to  fragments.  The  criteria  used  to 
define  the  kill  of  each  component/surf ace  are  supplied  by 
the  user.  The  program  utilizes  as  much  of  the  aircraft 
descriptions  that  are  prepared  for  the  SHOTGEN  and  VAREA 
programs  as  is  economically  feasible.  A  sufficiently  large 
number  of  encounter  conditions  are  assessed  to  generate  a 
single  shot  probability  of  kill  that  has  converged  to  a  user 
specified  confidence  level. 
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